Security issue: Trusted Reverse Proxy and X-Forwarded-* headers

[4n70w4]

Hi!

Now anyone can submit headers X-Forwarded-Proto and X-Forwarded-For for replace return values of this.Ctx.Input.Scheme() and this.Ctx.Input.IP(). There is no verification of the legitimacy of the value substitution. This can affect sensitive functionality and deceive the system.

Trusted Proxies — whitelist for describe ip's of reverse proxies on requests from which it is allowed to take values from X-Forwarded-* headers. If the request is not from a trusted proxy, X-Forwarded-* headers are ignored.

https://symfony.com/doc/3.2/components/http_foundation/trusting_proxies.html
https://github.com/fideloper/TrustedProxy

Examples:

If request ip in Trusted Proxies whitelist then:

• this.Ctx.Input.Scheme() get value from X-Forwarded-Proto header
• this.Ctx.Input.IP() get value from X-Forwarded-For header
• this.Ctx.Input.Host() get value from X-Forwarded-Host header

But if request ip NOT in Trusted Proxies whitelist then:

• this.Ctx.Input.Scheme() DON'T get value from X-Forwarded-Proto header
• this.Ctx.Input.IP() DON'T get value from X-Forwarded-For header
• this.Ctx.Input.Host() DON'T get value from X-Forwarded-Host header

[github-actions]

This issue is inactive for a long time.

[minpeter]

This feature is not patched even in the current version.
In the beego library, it seems to affect only access logging, but if the backend produced using beego uses "this.Ctx.Input.IP()" to restrict access, a serious security issue will occur. .

A typical example is the following blog post.
https://blog.ircmaxell.com/2012/11/anatomy-of-attack-how-i-hacked.html

To solve this problem, as mentioned by @4n70w4, you need to add the TrustedProxy function or trust the X-Forwarded-For header only for A number of reverse proxies running in front of the backend.
At least the configurable option

If you're not thinking of doing all this, I think there should be decent documentation mentioning the problem with this.Ctx.Input.IP().

Thank you for running a great project. 😎