un33k / node-ipware

Returns the real IP address of users in Node.js
MIT License
124 stars 17 forks source link

Add option to prefer last valid IP in comma-delimited header value, not first #2

Closed jstangroome closed 9 years ago

jstangroome commented 9 years ago

It appears the code currently recognises that a request header like X-Forwarded-For may have a comma-delimited list of IP addresses and will return the left-most valid routable IP address from the list.

However, as these headers are subject to spoofing, often it is only the right-most IP address in the list that can be trusted (because the proxy responsible for adding the right-most value is the only trusted proxy).

Perhaps introduce a config setting or optional argument that would cause a list to be processed right-to-left instead.

un33k commented 9 years ago

Good idea. I'll welcome a pull request or will push it up on next revision.

un33k commented 9 years ago

Implemented.

var ip_info = get_ip(req, right_most_proxy=True)