scidsg / hushline

Hush Line connects whistleblowers with organizations and people who can help.
https://hushline.app
GNU Affero General Public License v3.0
77 stars 21 forks source link

Incorrect and unconfigurable `X-Forwarded-*` proxy rules #626

Closed brassy-endomorph closed 1 month ago

brassy-endomorph commented 1 month ago

Is your feature request related to a problem? Please describe.

We have a repository for the app that is not guaranteed to be in sync with the repository for our production deployment (much less anyone else's). We configure the ProxyFix object like so:

https://github.com/scidsg/hushline/blob/5b6322b798407f808686ba8dcfb44e5d127313d2/hushline/__init__.py#L62-L66

This may be correct now, but on first look I'm not convinced it is.

Describe the solution you'd like

These values should be configurable. If any are set, then we set all values via env vars + defaults and apply the ProxyFix. This shouldn't be hardcoded and then only depend on the IS_PERSONAL_SERVER env var.

Additional Context

I'm not sure we actually depend on any of these values anywhere. As in as far as I can tell, the addresses pulled from the X-Fowarded-* are never used in any way. It might be simpler to just yank this entirely and then re-add it when necessary.