Description
Kyle M Hall (khall)
2025-04-30 15:10:15 UTC
Created attachment 181718 [details] [review] Bug 39789 - Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. Test Plan: 1) prove t/Koha/Middleware/RealIP.t This looks great Kyle. This will help out a lot! Created attachment 181720 [details] [review] Bug 39789 - Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. Test Plan: 1) prove t/Koha/Middleware/RealIP.t Wouldn't it make more sense to put this in koha-conf.xml alongside "koha_trusted_proxies"? (In reply to David Cook from comment #4) > Wouldn't it make more sense to put this in koha-conf.xml alongside > "koha_trusted_proxies"? Agreed! I will get this fixed up! Created attachment 181915 [details] [review] Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. Test Plan: 1) prove t/Koha/Middleware/RealIP.t Created attachment 181916 [details] [review] Bug 39789: Change syspref to config option Created attachment 181917 [details] [review] Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page Created attachment 181918 [details] [review] Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. Test Plan: 1) prove t/Koha/Middleware/RealIP.t Created attachment 181919 [details] [review] Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page Created attachment 181920 [details] [review] Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. Test Plan: 1) prove t/Koha/Middleware/RealIP.t Created attachment 181921 [details] [review] Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page Created attachment 182299 [details] [review] Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. Test Plan: 1) prove t/Koha/Middleware/RealIP.t Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> Created attachment 182300 [details] [review] Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> Created attachment 182395 [details] [review] Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. Test Plan: 1) prove t/Koha/Middleware/RealIP.t Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> Created attachment 182396 [details] [review] Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> Created attachment 182397 [details] [review] Bug 39789: Check requests for the custom header with fallback to X-Forwarded-For This patch updates the feature to allow both the custom header and X-Forwarded-For to work harmoniously For example, CloudFlare has it's own custom header. This patch allows a site to be configured for Cloudflare's proxy before the proxy is enabled. Created attachment 182841 [details] [review] Bug 39789: Check requests for the custom header with fallback to X-Forwarded-For This patch updates the feature to allow both the custom header and X-Forwarded-For to work harmoniously For example, CloudFlare has it's own custom header. This patch allows a site to be configured for Cloudflare's proxy before the proxy is enabled. Created attachment 182842 [details] [review] Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. Test Plan: 1) prove t/Koha/Middleware/RealIP.t Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> Created attachment 182843 [details] [review] Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> Created attachment 182844 [details] [review] Bug 39789: Check requests for the custom header with fallback to X-Forwarded-For This patch updates the feature to allow both the custom header and X-Forwarded-For to work harmoniously For example, CloudFlare has it's own custom header. This patch allows a site to be configured for Cloudflare's proxy before the proxy is enabled. Created attachment 182846 [details] [review] Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. Test Plan: 1) prove t/Koha/Middleware/RealIP.t Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> Created attachment 182847 [details] [review] Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. Test Plan: 1) prove t/Koha/Middleware/RealIP.t Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> Created attachment 182848 [details] [review] Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> Created attachment 182849 [details] [review] Bug 39789: Check requests for the custom header with fallback to X-Forwarded-For This patch updates the feature to allow both the custom header and X-Forwarded-For to work harmoniously For example, CloudFlare has it's own custom header. This patch allows a site to be configured for Cloudflare's proxy before the proxy is enabled. Planning to come back and review this next week... Created attachment 183215 [details] [review] Bug 39789: Add new "require_trusted_proxy_for_headers" 1) call will check the remote address against the list of trusted proxies first, if configured to do so, right off the bat. This allows us to not have to do this if we do not want to. Particularly useful if i were to tell an Koha server that it could only receive web requests from Cloudflare, or even if i was able to do that at the reverse proxy level. It's configurable so it can be disabled/enabled. a) If trusted, then it parses the header that was determined (from configuration or default X-Forwarded-For) b) Otherwise, it will fall back to the remote address 2) If not configured to check remote address against a trusted proxy, it will just parse the header that was determined. a) If it does not find a value, it will simply return the remote address. 3) "get_real_ip" no longer checks against trusted proxies, as that is done beforehand. Sorry I'm going to have to step back on QA for this one, as I've run out of Bugzilla time for a bit... |