08ce94d1c0
The real-client-IP lookup used by the --trusted-ip auth-bypass allowlist blindly trusted the leftmost value in X-Forwarded-For (or other configured --real-client-ip-header). When trusting X-Forwarded-For (which is the only header set by AWS ALB for example) the connecting peer's address is appended to X-Forwarded-For rather than replacing the header, and a client could set X-Forwarded-For to an allowlisted IP and have it trusted regardless of who actually connected to the proxy. The parser now walks the hop chain from the newest (rightmost) entry inward, skipping hops that are themselves trusted proxies, and returns the first entry that isn't. If the direct connecting peer isn't itself a trusted proxy, the header is ignored entirely. This reuses the existing --trusted-proxy-ip configuration, so behavior for deployments that leave it unset (today's documented trust-all default) is unchanged. Signed-off-by: Georgi Georgiev <310867+chutzimir@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| apis | ||
| app | ||
| authentication | ||
| cookies | ||
| encryption | ||
| header | ||
| ip | ||
| logger | ||
| middleware | ||
| providers | ||
| proxyhttp | ||
| requests | ||
| sessions | ||
| upstream | ||
| util | ||
| validation | ||
| version | ||
| watcher | ||