fbonalair / traefik-crowdsec-bouncer

A http service to verify request and bounce them according to decisions made by CrowdSec.
MIT License
272 stars 22 forks source link

Fix for Trusted Proxies and use ClientID() #14

Closed pewter77 closed 2 years ago

pewter77 commented 2 years ago

Not sure if you accept pull requests so here goes? This is related to #10

Sets this to work correctly on ClientID() which defaults to X-Forwarded-For behind a trusted proxy. Since this should be behind traefik and traefik decides which proxies it trusts before we can keep this set as 0.0.0.0/0 but there is an option to set this with the TRUSTED_PROXIES environmental variable.

Note that this might not be as performant as setting SetTrustedProxy(nil) and using ClientID() if you don't have proxies before Traefik. I wanted to add in some logic to set SetTrustedProxy(nil) instead if TRUSTED_PROXY wasn't set at all but my experience with go isn't that great and honestly not sure it even matters in most use cases for this bouncer but it is a potential for improvement if you want the previous functionality to stand.

codeclimate[bot] commented 2 years ago

Code Climate has analyzed commit 66256640 and detected 0 issues on this pull request.

View more on Code Climate.

aleksandarmomic commented 2 years ago

+1 Please review this 🙏