colin
/
pocketbase
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[#282] fixed X-Forward-For ip extraction

This commit is contained in:
Gani Georgiev 2022-08-20 05:56:56 +03:00
parent 72fdf0d116
commit beb8e7924d
1 changed files with 19 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
apis/middlewares.go
View File

@ -3,6 +3,7 @@ package apis
import ( import (
"fmt" "fmt"
"log" "log"
"net"
"net/http" "net/http"
"strings" "strings"
"time" "time"
@ -247,13 +248,15 @@ func ActivityLogger(app core.App) echo.MiddlewareFunc {
requestAuth = models.RequestAuthAdmin requestAuth = models.RequestAuthAdmin
} }
ip, _, _ := net.SplitHostPort(httpRequest.RemoteAddr)
model := &models.Request{ model := &models.Request{
Url: httpRequest.URL.RequestURI(), Url: httpRequest.URL.RequestURI(),
Method: strings.ToLower(httpRequest.Method), Method: strings.ToLower(httpRequest.Method),
Status: status, Status: status,
Auth: requestAuth, Auth: requestAuth,
UserIp: realUserIp(httpRequest), UserIp: realUserIp(httpRequest, ip),
RemoteIp: httpRequest.RemoteAddr, RemoteIp: ip,
Referer: httpRequest.Referer(), Referer: httpRequest.Referer(),
UserAgent: httpRequest.UserAgent(), UserAgent: httpRequest.UserAgent(),
Meta: meta, Meta: meta,
@ -299,22 +302,25 @@ func ActivityLogger(app core.App) echo.MiddlewareFunc {
} }
} }
// Returns the "real" user IP from common proxy headers // Returns the "real" user IP from common proxy headers (or fallbackIp if none is found).
// (fallback to [r.RemoteAddr]).
// //
// The returned IP shouldn't be trusted if not behind a trusted reverse proxy! // The returned IP shouldn't be trusted if not behind a trusted reverse proxy!
func realUserIp(r *http.Request) string { func realUserIp(r *http.Request, fallbackIp string) string {
ipHeaders := []string{ if ip := r.Header.Get("CF-Connecting-IP"); ip != "" {
"CF-Connecting-IP", return ip
"X-Forwarded-For",
"X-Real-Ip",
} }
for _, header := range ipHeaders { if ip := r.Header.Get("X-Forwarded-For"); ip != "" {
if ip := r.Header.Get(header); ip != "" { // extract only the last IP
return ip if i := strings.IndexAny(ip, ","); i > 0 {
return strings.TrimSpace(ip[:i])
} }
return ip
} }
return r.RemoteAddr if ip := r.Header.Get("X-Forwarded-For"); ip != "" {
return ip
}
return fallbackIp
} }