Currently, the parsing of the X-Forwarded-For header in this package is incorrect for applications deployed behind a Google Loadbalancer, please see the docs here.
This application will use the 0th element of X-Forwarded-For as the user's IP, but this is assignable by end-users in Google loadbalancers:
If the request includes an X-Forwarded-For header, the load balancer preserves the supplied value before the ,:
X-Forwarded-For: <supplied-value>,<client-ip>,<load-balancer-ip>
This package (as of 0.6.3) uses the following logic:
def _get_remote_addr():
address = request.headers.get("X-Forwarded-For", request.remote_addr)
if address is not None:
# An 'X-Forwarded-For' header includes a comma separated list of the
# addresses, the first address being the actual remote address.
address = address.encode("utf-8").split(b",")[0].strip()
return address
Which means if deployed behind a GLB the value of _get_remote_addr can be trivially spoofed.
I see that issue #700 raised this issue, and it has been resolved, but a release to Pypi has not been made with this patch.
Currently, the parsing of the X-Forwarded-For header in this package is incorrect for applications deployed behind a Google Loadbalancer, please see the docs here.
This application will use the 0th element of X-Forwarded-For as the user's IP, but this is assignable by end-users in Google loadbalancers:
This package (as of 0.6.3) uses the following logic:
Which means if deployed behind a GLB the value of
_get_remote_addrcan be trivially spoofed.I see that issue #700 raised this issue, and it has been resolved, but a release to Pypi has not been made with this patch.