plone / plone.recipe.zope2instance

zc.buildout recipe to setup and configure a Zope 2 instance.
https://pypi.org/project/plone.recipe.zope2instance
7 stars 23 forks source link

Add support fo trusted-proxy directive #61

Closed hvelarde closed 5 years ago

hvelarde commented 5 years ago

Currently access logs behind a proxy show the IP of the proxy, but according to Zope's documentation the trusted-proxy directive can be used to modify that behavior: if a request comes from a trusted proxy and contains an X_FORWARDED_FOR header, the address provided by X_FORWARDED_FOR will be logged.

# Directive: trusted-proxy
#     
# Description:
#     Define one or more 'trusted-proxies' directives, each of which is a
#     hostname or an IP address.  The set of definitions comprises a list
#     of front-end proxies that are trusted to supply an accurate
#     X-Forwarded-For header to Zope.  If a connection comes from
#     a trusted proxy, Zope will trust any X-Forwarded header to contain
#     the user's real IP address for the purposes of address-based
#     authentication restriction.
#     
# Default: unset
# 
# Example:
#     
#    trusted-proxy www.example.com
#    trusted-proxy 192.168.1.1

See also: https://github.com/zopefoundation/Zope/blob/2.13.28/src/ZServer/medusa/http_server.py#L43-L51

lukasgraf commented 5 years ago

I'm not opposed to a dedicated directive, but on the other hand, this works quite well already:

[instance]
zope-conf-additional +=
    trusted-proxy 192.168.1.1
hvelarde commented 5 years ago

well, that's easier; that directive is missing and we need to document it somewhere.