Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

HTTP_X_FORWARDED_FOR can be spoofed, proxies append to the list, so u… #11093

Merged
merged 1 commit into from
Aug 25, 2017
Merged

HTTP_X_FORWARDED_FOR can be spoofed, proxies append to the list, so u… #11093

merged 1 commit into from
Aug 25, 2017

Conversation

ceeram
Copy link
Contributor

@ceeram ceeram commented Aug 24, 2017

A proxy will append the client’s real IP address to the HTTP header, so use last ip instead of first ip, which could be manipulated by an attacker

@ceeram ceeram self-assigned this Aug 24, 2017
@markstory markstory added this to the 3.5.1 milestone Aug 24, 2017
@markstory markstory added the http label Aug 24, 2017
markstory
markstory approved these changes Aug 24, 2017
View reviewed changes
Copy link
Member

@markstory markstory left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me.

@markstory markstory merged commit fcb8736 into master Aug 25, 2017
@markstory markstory deleted the client-ip-spoofing branch August 25, 2017 00:56
@ceeram ceeram mentioned this pull request May 20, 2018
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@markstory markstory markstory approved these changes

Assignees

@ceeram ceeram

Labels
http
Projects
None yet
Milestone
3.5.1
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@ceeram @markstory