search

ryanbillingsley / express-ipfilter

A light-weight IP address based connection filtering system
MIT License
110 stars 44 forks source link

This could be easily bypassed #25

Closed carloslopez1990 closed 8 years ago

carloslopez1990 commented 8 years ago

Since u r using x-forwarded-for header and headers can of course be modified, creating random ip addresses and sending them through x-forwarded-for is possible...

SCBuergel commented 8 years ago

you could just as well use a VPN and avoid any detection altogether. I think the point is to provide an easy to use filter that blocks most "common" web traffic.

carloslopez1990 commented 8 years ago

using a VPN you have the same problem as using proxy... u get only one IP, if you use multiples proxys then get multiples IP's but still limited, but using x-forwarded-for and random ip addresses, u have all the ip's u want... so "using a VPN" is not as evil as the method i described, i'm talking for example of scenarios like form automation, web scrapping and more...

ryanbillingsley commented 8 years ago

@carloslopez1990 I am working on a new version that will make forwarded IPs disabled by default and only if you enable them will they then be used. This goes for CloudFlare and Codio as well.

ryanbillingsley commented 8 years ago

Please see https://github.com/baminteractive/express-ipfilter/pull/26 for the change.