Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

X-Forwarded-For with proxy addresses is not handled properly #602

Open
Scrin opened this issue Aug 3, 2024 · 1 comment
Open

X-Forwarded-For with proxy addresses is not handled properly #602

Scrin opened this issue Aug 3, 2024 · 1 comment

Comments

@Scrin
Copy link

Scrin commented Aug 3, 2024

It looks like if one uses a reverse proxy in front of MMR that includes X-Forwarded-For header with possible proxy address(es), MMR does not handle that properly. I believe the issue is here:

if config.Get().General.TrustAnyForward {
raddr = r.Header.Get("X-Forwarded-For")
} else {
raddr = xff.GetRemoteAddr(r)
}
if raddr == "" {
raddr = r.RemoteAddr
}
host, _, err := net.SplitHostPort(raddr)

If the raddr gets its value from the X-Forwarded-For and the header contains proxy addresses (see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For#syntax ), then the net.SplitHostPort fails to parse it

@Scrin
Copy link
Author

Scrin commented Aug 30, 2024

I can fix this, but I'd like to see #611 merged first to avoid conflicts, as mentioned in the MMR matrix room

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant