Bug 39789 - Add ability to specify an alternative header to X-Forwarded-For for finding the real IP address
Summary: Add ability to specify an alternative header to X-Forwarded-For for finding t...
Status: Signed Off
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low enhancement
Assignee: Kyle M Hall (khall)
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-04-30 15:10 UTC by Kyle M Hall (khall)
Modified: 2025-07-02 23:46 UTC (History)
3 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 39789 - Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address (4.00 KB, patch)
2025-04-30 15:55 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 39789 - Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address (4.32 KB, patch)
2025-04-30 16:13 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address (4.32 KB, patch)
2025-05-05 12:24 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 39789: Change syspref to config option (3.99 KB, patch)
2025-05-05 12:25 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page (1.69 KB, patch)
2025-05-05 12:25 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address (2.93 KB, patch)
2025-05-05 12:25 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page (1.69 KB, patch)
2025-05-05 12:26 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address (2.95 KB, patch)
2025-05-05 12:37 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page (1.69 KB, patch)
2025-05-05 12:37 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address (2.98 KB, patch)
2025-05-12 15:37 UTC, Lin Wei
Details | Diff | Splinter Review
Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page (1.72 KB, patch)
2025-05-12 15:37 UTC, Lin Wei
Details | Diff | Splinter Review
Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address (3.00 KB, patch)
2025-05-13 17:49 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page (1.74 KB, patch)
2025-05-13 17:49 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 39789: Check requests for the custom header with fallback to X-Forwarded-For (2.91 KB, patch)
2025-05-13 17:49 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 39789: Check requests for the custom header with fallback to X-Forwarded-For (3.15 KB, patch)
2025-05-29 16:16 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address (3.00 KB, patch)
2025-05-29 16:16 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page (1.74 KB, patch)
2025-05-29 16:17 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 39789: Check requests for the custom header with fallback to X-Forwarded-For (3.15 KB, patch)
2025-05-29 16:17 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address (3.00 KB, patch)
2025-05-29 16:48 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address (3.00 KB, patch)
2025-05-29 16:49 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page (1.74 KB, patch)
2025-05-29 16:50 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 39789: Check requests for the custom header with fallback to X-Forwarded-For (3.31 KB, patch)
2025-05-29 16:50 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 39789: Add new "require_trusted_proxy_for_headers" (3.56 KB, patch)
2025-06-12 18:44 UTC, Tristin Stagg
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Kyle M Hall (khall) 2025-04-30 15:10:15 UTC
Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed.
Comment 1 Kyle M Hall (khall) 2025-04-30 15:55:54 UTC
Created attachment 181718 [details] [review]
Bug 39789 - Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address

Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed.

Test Plan:
1) prove t/Koha/Middleware/RealIP.t
Comment 2 Tristin Stagg 2025-04-30 16:02:20 UTC
This looks great Kyle. This will help out a lot!
Comment 3 Kyle M Hall (khall) 2025-04-30 16:13:52 UTC
Created attachment 181720 [details] [review]
Bug 39789 - Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address

Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed.

Test Plan:
1) prove t/Koha/Middleware/RealIP.t
Comment 4 David Cook 2025-04-30 23:47:47 UTC
Wouldn't it make more sense to put this in koha-conf.xml alongside "koha_trusted_proxies"?
Comment 5 Kyle M Hall (khall) 2025-05-05 11:34:56 UTC
(In reply to David Cook from comment #4)
> Wouldn't it make more sense to put this in koha-conf.xml alongside
> "koha_trusted_proxies"?

Agreed! I will get this fixed up!
Comment 6 Kyle M Hall (khall) 2025-05-05 12:24:56 UTC
Created attachment 181915 [details] [review]
Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address

Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed.

Test Plan:
1) prove t/Koha/Middleware/RealIP.t
Comment 7 Kyle M Hall (khall) 2025-05-05 12:25:03 UTC
Created attachment 181916 [details] [review]
Bug 39789: Change syspref to config option
Comment 8 Kyle M Hall (khall) 2025-05-05 12:25:06 UTC
Created attachment 181917 [details] [review]
Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page
Comment 9 Kyle M Hall (khall) 2025-05-05 12:25:52 UTC
Created attachment 181918 [details] [review]
Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address

Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed.

Test Plan:
1) prove t/Koha/Middleware/RealIP.t
Comment 10 Kyle M Hall (khall) 2025-05-05 12:26:00 UTC
Created attachment 181919 [details] [review]
Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page
Comment 11 Kyle M Hall (khall) 2025-05-05 12:37:38 UTC
Created attachment 181920 [details] [review]
Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address

Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed.

Test Plan:
1) prove t/Koha/Middleware/RealIP.t
Comment 12 Kyle M Hall (khall) 2025-05-05 12:37:47 UTC
Created attachment 181921 [details] [review]
Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page
Comment 13 Lin Wei 2025-05-12 15:37:07 UTC
Created attachment 182299 [details] [review]
Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address

Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed.

Test Plan:
1) prove t/Koha/Middleware/RealIP.t

Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com>
Comment 14 Lin Wei 2025-05-12 15:37:09 UTC
Created attachment 182300 [details] [review]
Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page

Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com>
Comment 15 Kyle M Hall (khall) 2025-05-13 17:49:27 UTC
Created attachment 182395 [details] [review]
Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address

Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed.

Test Plan:
1) prove t/Koha/Middleware/RealIP.t

Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com>
Comment 16 Kyle M Hall (khall) 2025-05-13 17:49:36 UTC
Created attachment 182396 [details] [review]
Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page

Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com>
Comment 17 Kyle M Hall (khall) 2025-05-13 17:49:38 UTC
Created attachment 182397 [details] [review]
Bug 39789: Check requests for the custom header with fallback to X-Forwarded-For

This patch updates the feature to allow both the custom header and X-Forwarded-For to work harmoniously

For example, CloudFlare has it's own custom header.
This patch allows a site to be configured for Cloudflare's proxy before the proxy is enabled.
Comment 18 Kyle M Hall (khall) 2025-05-29 16:16:38 UTC
Created attachment 182841 [details] [review]
Bug 39789: Check requests for the custom header with fallback to X-Forwarded-For

This patch updates the feature to allow both the custom header and X-Forwarded-For to work harmoniously

For example, CloudFlare has it's own custom header.
This patch allows a site to be configured for Cloudflare's proxy before the proxy is enabled.
Comment 19 Kyle M Hall (khall) 2025-05-29 16:16:53 UTC
Created attachment 182842 [details] [review]
Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address

Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed.

Test Plan:
1) prove t/Koha/Middleware/RealIP.t

Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com>
Comment 20 Kyle M Hall (khall) 2025-05-29 16:17:06 UTC
Created attachment 182843 [details] [review]
Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page

Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com>
Comment 21 Kyle M Hall (khall) 2025-05-29 16:17:11 UTC
Created attachment 182844 [details] [review]
Bug 39789: Check requests for the custom header with fallback to X-Forwarded-For

This patch updates the feature to allow both the custom header and X-Forwarded-For to work harmoniously

For example, CloudFlare has it's own custom header.
This patch allows a site to be configured for Cloudflare's proxy before the proxy is enabled.
Comment 22 Kyle M Hall (khall) 2025-05-29 16:48:19 UTC
Created attachment 182846 [details] [review]
Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address

Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed.

Test Plan:
1) prove t/Koha/Middleware/RealIP.t

Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com>
Comment 23 Kyle M Hall (khall) 2025-05-29 16:49:54 UTC
Created attachment 182847 [details] [review]
Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address

Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed.

Test Plan:
1) prove t/Koha/Middleware/RealIP.t

Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com>
Comment 24 Kyle M Hall (khall) 2025-05-29 16:50:01 UTC
Created attachment 182848 [details] [review]
Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page

Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com>
Comment 25 Kyle M Hall (khall) 2025-05-29 16:50:04 UTC
Created attachment 182849 [details] [review]
Bug 39789: Check requests for the custom header with fallback to X-Forwarded-For

This patch updates the feature to allow both the custom header and X-Forwarded-For to work harmoniously

For example, CloudFlare has it's own custom header.
This patch allows a site to be configured for Cloudflare's proxy before the proxy is enabled.
Comment 26 David Cook 2025-05-30 00:58:03 UTC
Planning to come back and review this next week...
Comment 27 Tristin Stagg 2025-06-12 18:44:07 UTC
Created attachment 183215 [details] [review]
Bug 39789: Add new "require_trusted_proxy_for_headers"

1) call will check the remote address against the list of trusted proxies first, if configured to do so, right off the bat. This allows us to not have to do this if we do not want to. Particularly useful if i were to tell an Koha server that it could only receive web requests from Cloudflare, or even if i was able to do that at the reverse proxy level. It's configurable so it can be disabled/enabled.
    a) If trusted, then it parses the header that was determined (from configuration or default X-Forwarded-For)
    b) Otherwise, it will fall back to the remote address
2) If not configured to check remote address against a trusted proxy, it will just parse the header that was determined.
    a) If it does not find a value, it will simply return the remote address.
3) "get_real_ip" no longer checks against trusted proxies, as that is done beforehand.
Comment 28 David Cook 2025-07-02 23:46:56 UTC
Sorry I'm going to have to step back on QA for this one, as I've run out of Bugzilla time for a bit...