Logged IP 127.0.0.1 behind proxy

[ak]

If Nginx is used behind a proxy like Nginx, the IP of the author is always logged as 127.0.0.1. This is not desirable. The following patch can be used:

trac/web/api.py

@@ -348 +348 @@
     @property
     def remote_addr(self):
         """IP address of the remote user"""
-        return self.environ.get('REMOTE_ADDR')
+        return self.environ.get('HTTP_X_REAL_IP') or self.environ.get('REMOTE_ADDR')
 
     @property
     def remote_user(self):

[Jun Omae]

Using X-Real-IP would be to avoid troubles. But, I think X-Forwarded-For is in more common use.

trac/web/api.py

@@ -382 +382 @@
         """Query part of the request"""
         return self.environ.get('QUERY_STRING', '')
 
+    _x_forwarded_for_re = re.compile(r'\s*,\s*')
+
     @property
     def remote_addr(self):
         """IP address of the remote user"""
+        value = self.environ.get('HTTP_X_REAL_IP')
+        if value:
+            return value
+        value = self.environ.get('HTTP_X_FORWARDED_FOR')
+        if value:
+            # first address is the original client
+            return self._x_forwarded_for_re.split(value)[0]
         return self.environ.get('REMOTE_ADDR')
 
     @property

[ak]

Patch is included. I believe it is customary to add a keyword.

[Jun Omae]

After reconsideration, I'd suggest wontfix. We cannot always trust X-Real-IP header since anyone can send it with any value.

Instead, add the following to your *.wsgi script.

_known_remotes = ['192.168.0.2']  # replace with your proxy's addresses

def application(environ, start_request):
    if 'HTTP_X_REAL_IP' in environ and \
            environ.get('REMOTE_ADDR') in _known_remotes:
        environ['REMOTE_ADDR'] = environ['HTTP_X_REAL_IP']
    ....
    from trac.web.main import dispatch_request
    return dispatch_request(environ, start_request)

[Jun Omae]

Closing….

[Peter Suter]

(X-Forwarded-For was also discussed in #5199 and #863.)