AGH accepts all XFF headers without restriction

[ZeroClover]

In #1220, AGH accepts some HTTP headers to get the visitor's raw IP.

However, the AGH does not restrict which IPs can send these headers, but accepts them from all IPs.

This means that when the AGH is deployed publicly and uses DoH, rate limiting may be completely useless. The AGH administrator will not be able to use the AGH's own functionality to block malicious users.

I constructed some malicious requests on my AGH server to illustrate the problem more clearly. Obviously, Cloudflare and Google could not have used my server as an upstream.

Screenshot:

I recommend that AGH add a separate configuration to allow users to set trusted IPs and trust the local loopback by default (127.0.0.1).

[SukkaW]

@ainar-g

I am afraid it is not a feature request. It should be considered as a security issue.

AGH should implement a restriction to prevent "faking IP".

[ameshkov]

rate limiting may be completely useless

The thing is that rate-limiting currently only works for UDP, it is a measure for mitigating DNS amplification attacks, and other protocols aren't used for that.

This issue does make Access settings useless, though. It's labeled as "enhancement" (which is not a feature request) since it adds functionality (trusted IPs list).

[EugeneOne1]

@ZeroClover, there is a new build in the edge channel available. It implements the trusted proxies feature. It's also documented in an appropriate wiki section. Could you please check if it works for you?

[EugeneOne1]

We'll close the issue for now. You're welcome to open the new issues in case of encounter those.