From 6707467baecadbadc90906da0833d22831b8c283 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Wed, 8 Apr 2026 05:59:19 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9A=A8=20Flash:=20[CRITICAL]=20Fix=20x-fo?=
 =?UTF-8?q?rwarded-for=20proxy=20chain=20injection=20vulnerability?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Shreyassp002 <96625037+Shreyassp002@users.noreply.github.com>
---
 src/app/api/v1/payment-links/route.ts | 4 ++--
 src/lib/api/verify-api-key.ts         | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/app/api/v1/payment-links/route.ts b/src/app/api/v1/payment-links/route.ts
index 679f324..03280f8 100644
--- a/src/app/api/v1/payment-links/route.ts
+++ b/src/app/api/v1/payment-links/route.ts
@@ -140,14 +140,14 @@ export async function POST(req: NextRequest) {
   }
 
   // 6. Log API call (optional/async)
-  const clientIp = req.headers.get('x-forwarded-for') || 'unknown'
+  const clientIp = (req.headers.get('x-forwarded-for') || 'unknown').split(',')[0].trim()
   supabase.from('api_logs').insert({
     merchant_id: merchant.id,
     endpoint: '/api/v1/payment-links',
     method: 'POST',
     status_code: 201,
     request_body: body,
-    ip_address: clientIp.split(',')[0],
+    ip_address: clientIp,
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   }).then(({ error }: any) => {
     if (error) console.error('Failed to log API call', error)
diff --git a/src/lib/api/verify-api-key.ts b/src/lib/api/verify-api-key.ts
index 9b858a8..fc504ef 100644
--- a/src/lib/api/verify-api-key.ts
+++ b/src/lib/api/verify-api-key.ts
@@ -57,7 +57,7 @@ export async function verifyApiKey(req: NextRequest) {
         endpoint: req.nextUrl.pathname,
         method: req.method,
         status_code: 200, // Assumed success if we get here
-        ip_address: req.headers.get('x-forwarded-for') || 'unknown',
+        ip_address: (req.headers.get('x-forwarded-for') || 'unknown').split(',')[0].trim(),
         user_agent: req.headers.get('user-agent') || 'unknown'
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       }).then(({ error }: any) => {