From 808b1d7f37b2c354c9d1d7d50d1b334a4b481adf Mon Sep 17 00:00:00 2001 From: Markus Unterwaditzer Date: Tue, 23 Apr 2019 10:04:03 +0200 Subject: [PATCH 1/2] fix: Honor X-Real-IP --- sentry_sdk/integrations/wsgi.py | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/sentry_sdk/integrations/wsgi.py b/sentry_sdk/integrations/wsgi.py index 05587c60d2..8093c69310 100644 --- a/sentry_sdk/integrations/wsgi.py +++ b/sentry_sdk/integrations/wsgi.py @@ -98,7 +98,8 @@ def _get_environ(environ): """ keys = ("SERVER_NAME", "SERVER_PORT") if _should_send_default_pii(): - keys += ("REMOTE_ADDR",) # type: ignore + # Add all three headers here to make debugging of proxy setup easier. + keys += ("REMOTE_ADDR", "HTTP_X_FORWARDED_FOR", "HTTP_X_REAL_IP") for key in keys: if key in environ: @@ -129,16 +130,21 @@ def _get_headers(environ): def get_client_ip(environ): # type: (Dict[str, str]) -> Optional[Any] """ - Naively yank the first IP address in an X-Forwarded-For header - and assume this is correct. - - Note: Don't use this in security sensitive situations since this - value may be forged from a client. + Infer the user IP address from various headers. This cannot be used in + security sensitive situations since the value may be forged from a client, + but it's good enough for the event payload. """ try: return environ["HTTP_X_FORWARDED_FOR"].split(",")[0].strip() except (KeyError, IndexError): - return environ.get("REMOTE_ADDR") + pass + + try: + return environ["HTTP_X_REAL_IP"] + except KeyError: + pass + + return environ.get("REMOTE_ADDR") def _capture_exception(hub): From a10c6f3ca37c8bab36bf95149bd8a2711e152671 Mon Sep 17 00:00:00 2001 From: Markus Unterwaditzer Date: Tue, 23 Apr 2019 21:46:57 +0200 Subject: [PATCH 2/2] fix: Mypy --- sentry_sdk/integrations/wsgi.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sentry_sdk/integrations/wsgi.py b/sentry_sdk/integrations/wsgi.py index 8093c69310..1ee071c4b4 100644 --- a/sentry_sdk/integrations/wsgi.py +++ b/sentry_sdk/integrations/wsgi.py @@ -96,10 +96,10 @@ def _get_environ(environ): """ Returns our whitelisted environment variables. """ - keys = ("SERVER_NAME", "SERVER_PORT") + keys = ["SERVER_NAME", "SERVER_PORT"] if _should_send_default_pii(): # Add all three headers here to make debugging of proxy setup easier. - keys += ("REMOTE_ADDR", "HTTP_X_FORWARDED_FOR", "HTTP_X_REAL_IP") + keys += ["REMOTE_ADDR", "HTTP_X_FORWARDED_FOR", "HTTP_X_REAL_IP"] for key in keys: if key in environ: