API: IP address replacement wrong with reverse proxy not from loopback

[saibotk]

Describe the bug Hey, thank you for the awesome project!

I recently started using the bot and the web API with the traefik reverse-proxy and in a containerized setup, in which the request IP is not correctly resolved and instead the private IP of the proxy is shown.

This is due to this line I guess https://github.com/Splamy/TS3AudioBot/blob/4f17b2971e03bee94d1e630a2b5ce37d8a15e5ca/TS3AudioBot/Web/Api/WebApi.cs#L90 as docker network addresses usually come from 172.16.0.0/12 which is not the loopback address.

Maybe adding a configuration option like nginx does (set_real_ip_from 172.16.0.0/12;) would solve this appropriately?

If there is anything else i can help or provide, let me know!

To Reproduce Set up a reverse proxy connecting to the ts3audiobot from any other IP than the loopback and it will not respect the X-Real-IP header.

Version 0.11.0

Platform I am running the docker image (https://github.com/getdrunkonmovies-com/TS3AudioBot_docker)

Log Example of a log message:

INFO|| ::ffff:172.18.0.4 Requested: /api/system/info

[Bluscream]

Isn't the header X-Forwarded-For anyway?

[saibotk]

Isn't the header X-Forwarded-For anyway?

Thats an alternative, but i think X-Real-IP is still the commonly used/understood header. Also the X-Forwarded-For may also be a list of IPs instead of only the origin.

[Splamy]

Interesting problem, I think the easiest solution will probably be just adding a trusted ip settings field to the config. Unfortunately I'm currently on vacation and my laptop died liteally the day I arrived here, so I won't be able to code anything. I'll be back on the 1.9.