umputun / remark42 / 28721968231

85%

master: 85%

Build Type

Pull #2116

github

Committed by paskal

Commit Message

fix: add --trusted-proxy to gate client-IP forwarding headers

Rate limiting and (with --votes-ip) vote de-duplication key on the client IP,
recovered from forwarding headers (X-Real-IP / X-Forwarded-For / CF-Connecting-IP)
when behind a reverse proxy. Those headers were accepted from any client, so a
caller could set them to change its apparent IP.

Add --trusted-proxy / TRUSTED_PROXY (comma-separated CIDR/IP): forwarding headers
are honored only when the direct peer is a trusted proxy; other peers keep their
real socket address. Unset preserves the previous trust-all behavior (with a
startup warning) so existing deployments keep working on upgrade.

Docs: a 'Trusted proxies and client IP' section with per-topology guidance, plus a
note in the nginx manual.

Pull Request Pull Request #2116: fix: add --trusted-proxy to gate client-IP forwarding headers

Coverage Stats

51 of 59 new or added lines in 3 files covered. (86.44%)

2 existing lines in 1 file now uncovered.

6458 of 7648 relevant lines covered (84.44%)

36.69 hits per line