mfa fixing

internal/webui/utils.go

@@ -45,6 +45,27 @@ func fetchBody(client *http.Client, url string) string {
 	return string(b)
 }
 
+// requestIP returns the best-effort client IP for an HTTP request — the first hop of
+// X-Forwarded-For if present (this app is documented to run behind a reverse proxy),
+// falling back to the direct connection's address with its port stripped.
+func requestIP(r *http.Request) string {
+	if fwd := r.Header.Get("X-Forwarded-For"); fwd != "" {
+		if i := strings.Index(fwd, ","); i >= 0 {
+			fwd = fwd[:i]
+		}
+		if ip := strings.TrimSpace(fwd); ip != "" {
+			return ip
+		}
+	}
+	if realIP := r.Header.Get("X-Real-IP"); realIP != "" {
+		return realIP
+	}
+	if host, _, err := net.SplitHostPort(r.RemoteAddr); err == nil {
+		return host
+	}
+	return r.RemoteAddr
+}
+
 // resolverAt builds a resolver pinned to a specific DNS server, mirroring
 // utils.check_dns_record's hardcoded Cloudflare resolver (1.1.1.1), 5s timeout.
 func resolverAt(serverIP string) *net.Resolver {