Skip to content

Uvicorn via gunicorn worker doesn't respect --forwarded-allow-ips #589

Description

@b0g3r

I use uvicorn in docker as uvicorn-worker for gunicorn for my fastapi app. My application needs to know the real client IP of each request, so I use proxy-server with the X-Forwarded-For header.

Gunicorn has a special option to change proxy-ip to real-ip, so I running gunicorn like this:

gunicorn \
  ppm_telegram_bot.api:app \
  --forwarded-allow-ips="*" 
  --worker-class=uvicorn.workers.UvicornWorker \
  --bind=0.0.0.0:$PORT

Because I'm in a container, my WSGI/ASGI server receives requests not from the localhost, but from the docker network.

But uvicorn-worker doesn't respect gunicorn's forwarded-allow-ips, so in ProxyHeadersMiddleware.trusted_hosts I receive default 127.0.0.1 and proxy-ip instead of real-ip.
https://github.com/encode/uvicorn/blob/9d9f8820a8155e36dcb5e4d4023f470e51aa4e03/uvicorn/middleware/proxy_headers.py#L14-L17

It looks like uvicorn-worker can forward this information to config via config_kwargs: https://github.com/encode/uvicorn/blob/9d9f8820a8155e36dcb5e4d4023f470e51aa4e03/uvicorn/workers.py#L28-L35

I could do PR with this change, if required 🙌

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions