vpndetection-fastapi 2.1.2__tar.gz → 2.1.3__tar.gz

{vpndetection_fastapi-2.1.2 → vpndetection_fastapi-2.1.3}/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 What each release changed for you, newest first. Each line is a commit's summary, linked to its full description and diff. Releases before 2.0.5 are described by their release commits.
 
+## 2.1.3 - 2026-10-10
+
+### Fixes
+
+- Require vpndetection 5.7.1: the spec re-pinned to 2026.10.09 ([`62563b2`](https://github.com/vpndetection-io/sdk-python-fastapi/commit/62563b2ec2b31e6b317d836c229f939bb9f0ec30))
+
 ## 2.1.2 - 2026-10-06
 
 ### Features

{vpndetection_fastapi-2.1.2 → vpndetection_fastapi-2.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: vpndetection-fastapi
-Version: 2.1.2
+Version: 2.1.3
 Summary: Official FastAPI and Starlette middleware for the VPNDetection API. Detect VPNs, proxies, Tor, hosting and CDN visitors on every request.
 Project-URL: Homepage, https://vpndetection.io
 Project-URL: Source, https://github.com/vpndetection-io/sdk-python-fastapi
@@ -20,7 +20,7 @@ Classifier: Topic :: Security
 Classifier: Typing :: Typed
 Requires-Python: >=3.11
 Requires-Dist: starlette>=0.37
-Requires-Dist: vpndetection<6,>=5.7.0
+Requires-Dist: vpndetection<6,>=5.7.1
 Provides-Extra: dev
 Requires-Dist: fastapi>=0.115; extra == 'dev'
 Requires-Dist: mypy>=1.11; extra == 'dev'
@@ -112,7 +112,7 @@ A refused request gets an `HTTPException`, `403` with `{"detail": "access denied
 
 This is the setting that decides whether any of the above works, and it is the one thing only you can get right.
 
-By default the middleware uses `request.client.host`, which is the socket peer unless the server was started with proxy-header support. Behind a load balancer without it, every visitor looks like the load balancer — a datacenter address, so a hosting rule would block all of them. Starting uvicorn with `--proxy-headers --forwarded-allow-ips=<your proxy>` is the server's own answer, and the one that knows your topology.
+By default the middleware uses `request.client.host`. uvicorn, and `fastapi run` with it, reads proxy headers by default, but only from a peer that `--forwarded-allow-ips` trusts, and that defaults to `127.0.0.1,::1` (or `$FORWARDED_ALLOW_IPS`). So behind a proxy on the same machine, the visitor's address arrives with no setup. Behind one anywhere else, such as nginx in its own container or a load balancer in a VPC, every visitor looks like the proxy. That address is usually a private one, which the middleware answers locally: nobody is flagged, nothing is blocked, and the private-address warning below is the only sign. Name your proxy, by its address or its subnet: `--forwarded-allow-ips=172.28.5.0/28`. gunicorn's own `--forwarded-allow-ips` works the same way. Never pass `*`. It trusts every peer, so the left-most `X-Forwarded-For` entry wins, and that is whatever the visitor sent: someone on a VPN who sends `X-Forwarded-For: 1.1.1.1` is looked up as `1.1.1.1`.
 
 For an edge that writes the address into its own header, name the header:
 

{vpndetection_fastapi-2.1.2 → vpndetection_fastapi-2.1.3}/README.md

@@ -82,7 +82,7 @@ A refused request gets an `HTTPException`, `403` with `{"detail": "access denied
 
 This is the setting that decides whether any of the above works, and it is the one thing only you can get right.
 
-By default the middleware uses `request.client.host`, which is the socket peer unless the server was started with proxy-header support. Behind a load balancer without it, every visitor looks like the load balancer — a datacenter address, so a hosting rule would block all of them. Starting uvicorn with `--proxy-headers --forwarded-allow-ips=<your proxy>` is the server's own answer, and the one that knows your topology.
+By default the middleware uses `request.client.host`. uvicorn, and `fastapi run` with it, reads proxy headers by default, but only from a peer that `--forwarded-allow-ips` trusts, and that defaults to `127.0.0.1,::1` (or `$FORWARDED_ALLOW_IPS`). So behind a proxy on the same machine, the visitor's address arrives with no setup. Behind one anywhere else, such as nginx in its own container or a load balancer in a VPC, every visitor looks like the proxy. That address is usually a private one, which the middleware answers locally: nobody is flagged, nothing is blocked, and the private-address warning below is the only sign. Name your proxy, by its address or its subnet: `--forwarded-allow-ips=172.28.5.0/28`. gunicorn's own `--forwarded-allow-ips` works the same way. Never pass `*`. It trusts every peer, so the left-most `X-Forwarded-For` entry wins, and that is whatever the visitor sent: someone on a VPN who sends `X-Forwarded-For: 1.1.1.1` is looked up as `1.1.1.1`.
 
 For an edge that writes the address into its own header, name the header:
 

{vpndetection_fastapi-2.1.2 → vpndetection_fastapi-2.1.3}/pyproject.toml

@@ -24,7 +24,7 @@ classifiers = [
     "Topic :: Security",
     "Typing :: Typed",
 ]
-dependencies = ["vpndetection>=5.7.0,<6", "starlette>=0.37"]
+dependencies = ["vpndetection>=5.7.1,<6", "starlette>=0.37"]
 
 [project.urls]
 Homepage = "https://vpndetection.io"

{vpndetection_fastapi-2.1.2 → vpndetection_fastapi-2.1.3}/src/vpndetection_fastapi/__init__.py

@@ -45,7 +45,7 @@ __all__ = [
     "xff_ip_selector",
 ]
 
-__version__ = "2.1.2"
+__version__ = "2.1.3"
 
 # Set on a request ``skip`` claimed, so block_if can tell it from one the middleware
 # never saw.
@@ -58,13 +58,14 @@ _SELECTORS: Selectors[Request] = bind_selectors(
     )
 )
 
-#: ``request.client.host``, which is the socket peer unless the app was started with
-#: uvicorn's ``--proxy-headers``.
+#: ``request.client.host``. uvicorn reads proxy headers into it by default, but only
+#: from a peer ``--forwarded-allow-ips`` trusts, which defaults to ``127.0.0.1,::1``.
 #:
-#: Behind a load balancer without it, every visitor looks like the load balancer - a
-#: datacenter address a hosting rule would block them all for. If you are behind one,
-#: pass ``--proxy-headers --forwarded-allow-ips=<your proxy>`` (the server's own answer,
-#: and the one that knows your topology) or use :func:`header_ip_selector`.
+#: Behind a proxy anywhere else, every visitor looks like the proxy, usually a private
+#: address that is answered locally, so nobody is flagged and the private-address
+#: warning is the only sign. Pass ``--forwarded-allow-ips=<your proxy's address or
+#: subnet>``, never ``*``, which takes the left-most ``X-Forwarded-For`` entry a visitor
+#: can forge, or use :func:`header_ip_selector`.
 default_ip_selector: IpSelector[Request] = _SELECTORS.default
 
 #: An address from ``X-Forwarded-For``.