Open Chheung opened 1 year ago
So X-Forwarded-For header can be exploited with this library if we add XFF header in the request. On Nginx, we can use the alternative X-Real-IP header for $remote_addr value.
X-Forwarded-For
X-Real-IP
$remote_addr
Maybe we can add something like below?
app.use( clientIp.mw({ prioritize: ["x-real-ip",], }) );
This will push change header priority list from default [ 'x-client-ip', 'x-forwarded-for', 'cf-connecting-ip', 'fastly-client-ip', 'true-client-ip', 'x-real-ip', 'x-cluster-client-ip', 'x-forwarded', 'forwarded-for', 'forwarded', 'x-appengine-user-ip', ];
default
[ 'x-client-ip', 'x-forwarded-for', 'cf-connecting-ip', 'fastly-client-ip', 'true-client-ip', 'x-real-ip', 'x-cluster-client-ip', 'x-forwarded', 'forwarded-for', 'forwarded', 'x-appengine-user-ip', ];
to
[ 'x-real-ip', 'x-client-ip', 'x-forwarded-for', 'cf-connecting-ip', 'fastly-client-ip', 'true-client-ip', 'x-cluster-client-ip', 'x-forwarded', 'forwarded-for', 'forwarded', 'x-appengine-user-ip', ];
I will make a PR on this. https://github.com/pbojinov/request-ip/pull/76
So
X-Forwarded-For
header can be exploited with this library if we add XFF header in the request. On Nginx, we can use the alternativeX-Real-IP
header for$remote_addr
value.Maybe we can add something like below?
app.use( clientIp.mw({ prioritize: ["x-real-ip",], }) );
This will push change header priority list from
default
[ 'x-client-ip', 'x-forwarded-for', 'cf-connecting-ip', 'fastly-client-ip', 'true-client-ip', 'x-real-ip', 'x-cluster-client-ip', 'x-forwarded', 'forwarded-for', 'forwarded', 'x-appengine-user-ip', ];
to
[ 'x-real-ip', 'x-client-ip', 'x-forwarded-for', 'cf-connecting-ip', 'fastly-client-ip', 'true-client-ip', 'x-cluster-client-ip', 'x-forwarded', 'forwarded-for', 'forwarded', 'x-appengine-user-ip', ];