mirror of
https://github.com/sol1/rustguac.git
synced 2026-10-24 20:52:24 +00:00
Dave Kempe
220aec81ee
client_ip took the LEFTMOST X-Forwarded-For entry from a trusted proxy. Behind any proxy that appends to an incoming header (nginx $proxy_add_x_forwarded_for, as our own reverse-proxy doc recommended, or Apache mod_proxy), that entry is whatever the client sent, so a client could pick an address inside an IP allowlist and walk through it. The header is now walked from the right, skipping trusted proxies, across every header line, split on raw bytes so a non-UTF-8 left entry cannot hide the address a proxy appended. Rate limiters used tower_governor's SmartIpKeyExtractor, which believes forwarded headers from any peer: a different forged X-Forwarded-For per request meant a fresh bucket each time, including on the always-on OIDC limiter. They now key on the same trusted-proxy resolution. When rate_limit is enabled, the API and WebSocket limiters sit outside authentication so requests with bad credentials are counted. The OIDC burst goes from 5 to 20 to cover an office behind one NAT address. Docs: nginx recipe overwrites X-Forwarded-For with $remote_addr, and the rate-limit section now states what is actually limited and when.