vbatts/ntfy
1
0
Fork 0
Code Pull requests Activity

Only use last X-Forwarded-For address as visitor address, closes #328

Browse source
This commit is contained in:
Philipp Heckel 2022-06-16 15:31:09 -04:00
parent 1fae61e78f
commit 9918f4965d
5 changed files with 53 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
server/server.go
View file

@ -1382,8 +1382,12 @@ func (s *Server) visitor(r *http.Request) *visitor {
if err != nil {
ip = remoteAddr // This should not happen in real life; only in tests.
}
if s.config.BehindProxy && r.Header.Get("X-Forwarded-For") != "" {
ip = r.Header.Get("X-Forwarded-For")
if s.config.BehindProxy && strings.TrimSpace(r.Header.Get("X-Forwarded-For")) != "" {
// X-Forwarded-For can contain multiple addresses (see #328). If we are behind a proxy,
// only the right-most address can be trusted (as this is the one added by our proxy server).
// See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For for details.
ips := util.SplitNoEmpty(r.Header.Get("X-Forwarded-For"), ",")
ip = strings.TrimSpace(util.LastString(ips, remoteAddr))
}
return s.visitorFromIP(ip)
}