[PATCH] Disable check_auth_ip by default

[pjdelport@…]

The check_auth_ip option (currently enabled by default) breaks a large number of legitimate network configurations. I am from South Africa, for example, which uses a national caching HTTP proxy layer with no single client IP address, so most people in the country can not log into a Trac instance that leaves this option at its default (i.e., most of them). Caching proxies everywhere are similarly affected, as well as multi-homing setups, NAT routers, and everything else that invalidates the presumption that a user agent corresponds to an IP addresses.

That said, there are specific deployments where this option can be usefully turned on, but the administrator will know when it is safe to turn on: for the general internet, i don't think Trac should default to breaking valid clients.

The attached patch changes the default value for check_auth_ip to false, and adjusts the unit test accordingly.

[Remy Blank]

(The patch is missing, but I guess it's pretty obvious how it should look like.)

I'm not sure about this. Is check_auth_ip = false a security issue? The option was introduced in [1361] to allow disabling the IP check, see #507.

[Piet Delport <pjdelport@…>]

Change the check_auth_ip option's default value from true to false.

[Piet Delport <pjdelport@…>]

(The patch is missing, but I guess it's pretty obvious how it should look like.)

Sorry, i must have botched the attachment during submission. Patch now attached. :)

I'm not sure about this. Is check_auth_ip = false a security issue? The option was introduced in [1361] to allow disabling the IP check, see #507.

Any security provided by this check is largely false: the same thing that makes it break valid clients also makes it miss actual attackers. There is not a one-to-one correspondence between HTTP user agents and IP addresses.

This check could conceivably be useful for specialized Trac installations with controlled client bases (for example, corporate settings), but it should be explicitly enabled: for general, Internet-facing contexts, it is a Really Bad Idea, and should never be done.

[Remy Blank]

Patch applied in [7613]. Thanks!

[Piet Delport <pjdelport@…>]

Cool, thanks!