umami
umami copied to clipboard
Location statistics broken when tracking IPv6 clients
src/lib/detect.ts line 144 tries to remove of a port possibly contained in the client IP string (extracted from potentially a header) by simply splitting on : and returning the first part.
That client IP can very much be an IPv6 address (in my case forwarded from the reverse proxy in front of umami as X-Forwarded-For) and IPv6 addresses do contain plenty of colons. That makes the recorded geolocation data completely incorrect.
Also, when HAProxy is configured for handling IPv6, x-forwarded-for can look like ::ffff:1.2.3.4 for IPv4 addresses, which would also be incorrectly parsed by the current implementation.