From 50cf6cfa8f83775a0b65e5efe2f3287d9cbd8262 Mon Sep 17 00:00:00 2001 From: Kyle M Hall Date: Thu, 6 Jun 2019 15:35:10 -0400 Subject: [PATCH] Bug 23068: Add ability for Koha to handle X-Forwarded-For headers so REMOTE_ADDR features work behind a proxy Koha has a number of features that rely on knowing the IP address of the connecting client. If that server is behind a proxy these features do not work. We can use Plack::Middleware::RealIP to automatically convert the X-Forwarded-For header into the REMOTE_ADDR environment variable so no Koha code need be modified. We can take advantage of the module's trusted_proxy setting to allow Koha to use these feature even after going through *multiple* proxies. TEST PLAN: 1) Apply this patch set 2) Install Plack::Middleware::RealIP via cpanm or your favorite utility 3) Update your plack.psgi with the changes you find in this patch set ( this process differs based on your testing environment ) 4) Restart plack 5) Tail the plack error log for your instance 6) Use curl to access the OPAC, adding an X-Forwarded-For header: curl --header "X-Forwarded-For: 32.32.32.32" http://127.0.0.1:8080 7) Note the logs output this address if you are unproxied 8) If you are proxied, restart plack using a command like below, where the ip you see in the logs is what you put in the environment variable: KOHA_TRUSTED_PROXIES="172.22.0.1 1.1.1.1" koha-plack --restart kohadev 9) Repeat step 6 7) You should now see 32.32.32.32 as the remote address in your logs! Signed-off-by: Martin Renvoize --- debian/templates/plack.psgi | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/debian/templates/plack.psgi b/debian/templates/plack.psgi index 3538b9a5a1..b80a556e45 100644 --- a/debian/templates/plack.psgi +++ b/debian/templates/plack.psgi @@ -68,6 +68,12 @@ my $apiv1 = builder { builder { enable "ReverseProxy"; enable "Plack::Middleware::Static"; + + my @proxies = split( / /, $ENV{KOHA_TRUSTED_PROXIES} ); + enable 'Plack::Middleware::RealIP', + header => 'X-Forwarded-For', + trusted_proxy => [@proxies]; + # + is required so Plack doesn't try to prefix Plack::Middleware:: enable "+Koha::Middleware::SetEnv"; -- 2.20.1