Relay: trust X-Forwarded-For only from the proxy itself #116
No reviewers
Labels
No labels
area/ci
area/desktop
area/packaging
area/protocol
area/reading
area/ui
area/web
area/writing
kind/bug
kind/feature
kind/infra
kind/request
needs/user
parked
perf
security
upstream
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
littlefox/neokom!116
Loading…
Reference in a new issue
No description provided.
Delete branch "issue-114-proxy-peer"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Closes #114
NEOKOM_RELAY_TRUST_PROXY:1now means "a proxy on loopback", or a comma-separated list of proxy addresses. X-Forwarded-For only counts on connections from those; everyone else is counted by their TCP address.Verified: unit test for the address choice, an integration test (separate limits behind a trusted proxy, forged header ignored otherwise), and tools/web-image-smoke.sh on a fresh image: https clients logged by their own address, forged
X-Forwarded-For: 6.6.6.6through Caddy and on 4895 ignored. The same smoke check fails on the current published image.🤖 Generated with Claude Code
https://claude.ai/code/session_01XJW2ocwLunyaLiUwCBHEP8
In the Docker image's HTTPS mode Caddy reaches the relay on loopback, so every https user counted as 127.0.0.1 and they shared one per-address limit. Turning on NEOKOM_RELAY_TRUST_PROXY wasn't safe either: port 4895 is published too, and any direct client could have named its own address. Now the header only counts on connections from trusted proxy addresses ("1" means loopback, or a list), and the image turns that on. The smoke test checks both ways: https clients by their own address, and a forged header through Caddy and on 4895 ignored; it fails on the old image. Also D-040: the user's answers for the public relay. Refs #114 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XJW2ocwLunyaLiUwCBHEP8Merged too early: I waited only for the branch run (#195) and not for the PR's packaging run (#196), which failed; main's run after the merge (#197) failed as well. Neither failure was in code this PR changed: the nix job hung after a finished build (#119), and the desktop smoke test lost a key press (#118); the same code passed both jobs on other runs. tools/forge.py pr-merge now refuses unless every run of the head commit passed.