porech
Allow using 'x-forwarded-for' as source ip addr
Now it can use 'x-forwarded-for' as the real source IP address, for some situations like the http server behind the Cloudflare
Enable it with forwarded_as_sources_ip
Test with Cloudflare CDN service:
-
Without
forwarded_as_sources_ip, the module didn't detect my real source IP. -
With
forwarded_as_sources_ip, the module now can detect my real source IP.
This is insecure and should not be merged as-is. The X-Forwarded-For header is spoofable. (Someone could set the header to an IP from an allowed country then send that directly to Caddy)
Caddy provides a secure way of reading the data from that header via https://caddyserver.com/docs/caddyfile/options#trusted-proxies. The plugin could read from the client_ip stored in the request context, and match against that.
This is insecure and should not be merged as-is. The
X-Forwarded-Forheader is spoofable. (Someone could set the header to an IP from an allowed country then send that directly to Caddy)Caddy provides a secure way of reading the data from that header via https://caddyserver.com/docs/caddyfile/options#trusted-proxies. The plugin could read from the
client_ipstored in the request context, and match against that.
Yeah, that's correct. It's what I wanted to answer, then my wife had a baby and I totally forgot about this :P I'm gonna make the change to rely on Caddy's first-class support for this. PRs welcome meanwhile :)
Yes, caddy now is support client_ip, before that, I used it long time ago.
Yes, caddy now is support client_ip, before that, I used it long time ago.
Yeah, I see and I'm happy your fork solved the situation for you. Actually, first-class support for client IP was introduced with https://github.com/caddyserver/caddy/pull/5104 that dates a little before your pull request. That's why I never merged it: I planned to rely on Caddy official support, but I never managed to implement it and I forgot to update about this on this PR. My fault, sorry.
If you or @francislavoie or anyone else is willing to do a PR for this, that would be really appreciated.
@ale-rinaldi
If you or @francislavoie or anyone else is willing to do a PR for this, that would be really appreciated.
Ready! PR https://github.com/porech/caddy-maxmind-geolocation/pull/26 and https://github.com/porech/caddy-maxmind-geolocation/pull/27
