New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Trusts addresses from the client provided X-Forwarded-For header #45

Open

Gunni opened this issue Jul 11, 2019 · 1 comment

Gunni commented Jul 11, 2019

Arrive at a page blocked using ipfilter.

Spoof the X-Forwarded-For header with a permitted IP.

Refresh.

Access granted...

Author

Gunni commented Jul 11, 2019 •

edited

Loading

Just discovered the strict keyword, not documented on https://caddyserver.com/docs/http.ipfilter

This behaviour is a bad default.

Suggestion: default to strict but allow the admin to provide an array of trusted proxy IPs where you can trust this header.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment