fix: correct real IP header in nginx configs#8981
fix: correct real IP header in nginx configs#8981717986230 wants to merge 3 commits intomakeplane:previewfrom
Conversation
|
|
📝 WalkthroughWalkthroughThis PR fixes a typo in three Nginx configuration files, correcting the Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 7/8 reviews remaining, refill in 7 minutes and 30 seconds.Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@apps/admin/nginx/nginx.conf`:
- Around line 12-15: The nginx configs currently set_real_ip_from 0.0.0.0/0
which trusts all proxies and allows X-Forwarded-For spoofing; replace the
set_real_ip_from entry in the nginx blocks (the set_real_ip_from directive
paired with real_ip_header X-Forwarded-For and real_ip_recursive on) in
apps/admin/nginx/nginx.conf, apps/web/nginx/nginx.conf and
apps/space/nginx/nginx.conf with your trusted proxy CIDR (for docker-compose use
the docker bridge like 172.17.0.0/16 or your ingress subnet) and ensure the same
CIDR is applied consistently across all three files; if your deployment uses
multiple proxy subnets, add multiple set_real_ip_from lines for each trusted
CIDR.
In `@apps/space/nginx/nginx.conf`:
- Around line 12-15: The configuration currently sets set_real_ip_from to
0.0.0.0/0 which allows any client to claim an X-Forwarded-For address and can
bypass IP-based controls; change the set_real_ip_from directive(s) to only
include your trusted ingress/load-balancer CIDR(s) or specific IP(s) (e.g., your
cluster LB CIDR like 10.0.0.0/8 or the specific load balancer IP) so
real_ip_header (X-Forwarded-For) is only trusted from those sources and rate
limiting in limit_req_zone against $binary_remote_addr and zone=mylimit cannot
be spoofed.
In `@apps/web/nginx/nginx.conf`:
- Around line 12-15: The real IP configuration is too permissive: replace the
broad set_real_ip_from 0.0.0.0/0 with only your trusted proxy CIDR(s) (e.g., the
load balancer or CDN networks) so real_ip_header X-Forwarded-For is only trusted
from those sources; update set_real_ip_from entries accordingly (or remove the
directive if no trusted proxies exist) to prevent forged client IPs affecting
limit_req_zone $binary_remote_addr and related rate-limiting logic.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 327116d2-f5c6-4040-b680-6714ad285527
📒 Files selected for processing (3)
apps/admin/nginx/nginx.confapps/space/nginx/nginx.confapps/web/nginx/nginx.conf
| set_real_ip_from 0.0.0.0/0; | ||
| real_ip_recursive on; | ||
| real_ip_header X-Forward-For; | ||
| real_ip_header X-Forwarded-For; | ||
| limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s; |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify where permissive real_ip trust is still configured
rg -nP '^\s*set_real_ip_from\s+0\.0\.0\.0/0;' apps
rg -n -C2 'set_real_ip_from|real_ip_header|real_ip_recursive|limit_req_zone' apps/**/nginx/nginx.confRepository: makeplane/plane
Length of output: 1760
🏁 Script executed:
# Search for deployment/infrastructure configuration
find . -type f \( -name "docker-compose*.yml" -o -name "Dockerfile*" -o -name "*.yaml" -o -name "*.yml" \) ! -path "*/node_modules/*" ! -path "*/.git/*" | head -20
# Check for any comments or documentation about nginx proxy setup
rg -n "set_real_ip_from|proxy_pass|trusted.*proxy|ingress" --type yaml --type yml -A 2 -B 2
# Look for kubernetes or helm configs
find . -type d \( -name "k8s" -o -name "kubernetes" -o -name "helm" -o -name "charts" \) 2>/dev/nullRepository: makeplane/plane
Length of output: 889
🏁 Script executed:
# Explore kubernetes deployment structure
find ./deployments/kubernetes -type f -name "*.yaml" -o -name "*.yml" | head -20
# Check for docker-compose
find . -maxdepth 3 -name "docker-compose*.y*ml" -o -name "compose*.y*ml"
# Look for ingress controller config
rg -n "kind:\s*Ingress|apiVersion" ./deployments/kubernetes/ -A 3
# Check if there's documentation about deployment
find . -maxdepth 2 -type f \( -name "README*" -o -name "DEPLOYMENT*" -o -name "ARCHITECTURE*" \)Repository: makeplane/plane
Length of output: 119
🏁 Script executed:
# Check docker-compose to see how services are networked
head -100 ./docker-compose.yml
# Check if README mentions nginx or deployment architecture
rg -n "nginx|proxy|ingress|deploy" ./README.md -i -A 2 -B 1
# Look at kubernetes service definitions to understand traffic flow
find ./deployments/kubernetes -type f \( -name "*.yaml" -o -name "*.yml" \) | xargs grep -l "kind.*Service\|kind.*Ingress" 2>/dev/null | head -5Repository: makeplane/plane
Length of output: 2426
🏁 Script executed:
# Get port mappings from docker-compose
rg -n "ports:" ./docker-compose.yml -A 5
# Check one Dockerfile to see how nginx is configured
head -50 ./apps/web/Dockerfile.web
# Look at kubernetes services to understand traffic ingress
find ./deployments/kubernetes -type f -name "*.yaml" -o -name "*.yml" | xargs grep -l "Service\|Ingress" | head -3Repository: makeplane/plane
Length of output: 2062
🏁 Script executed:
# Check the full Dockerfile.web, especially final stage
tail -100 ./apps/web/Dockerfile.web
# Search for nginx references in Dockerfiles
rg -n "nginx" ./apps/web/Dockerfile.web ./apps/admin/Dockerfile.admin ./apps/space/Dockerfile.space
# Check if there's a proxy service in docker-compose
rg -n "proxy:" ./docker-compose.yml -A 20
# Check the entrypoint or cmd for web service
rg -n "CMD\|ENTRYPOINT\|entrypoint\|command:" ./apps/web/Dockerfile.webRepository: makeplane/plane
Length of output: 4150
🏁 Script executed:
# Check proxy Dockerfile to understand traffic forwarding
head -150 ./apps/proxy/Dockerfile.ce
# Check if there's nginx config in proxy
find ./apps/proxy -name "nginx.conf" -o -name "*.conf"
# Look at kubernetes deployment to see if architecture differs
ls -la ./deployments/kubernetes/Repository: makeplane/plane
Length of output: 692
🏁 Script executed:
# Check Caddyfile configuration
cat ./apps/proxy/Caddyfile.ce
# Check kubernetes structure
find ./deployments/kubernetes/community -type f | head -20Repository: makeplane/plane
Length of output: 871
🏁 Script executed:
# Check kubernetes README and deployment structure
cat ./deployments/kubernetes/community/README.md
# List kubernetes manifest files
find ./deployments/kubernetes/community -type f -name "*.yaml" -o -name "*.yml" | sortRepository: makeplane/plane
Length of output: 316
🏁 Script executed:
# List all kubernetes files in community directory
find ./deployments/kubernetes/community -type f -not -path "*/\.*"
# Check if there are any actual k8s manifests beyond README
ls -la ./deployments/kubernetes/community/Repository: makeplane/plane
Length of output: 271
Restrict trusted proxy CIDRs in all nginx configs (web, admin, space).
This configuration appears in three files (apps/web/nginx/nginx.conf, apps/admin/nginx/nginx.conf, and apps/space/nginx/nginx.conf). All currently trust X-Forwarded-For from 0.0.0.0/0, enabling clients to spoof source IPs and weakening per-client rate limiting.
In the docker-compose deployment, these nginx services are behind Caddy and not directly exposed, but should still restrict to the internal docker network range. In production deployments, this becomes critical.
Replace set_real_ip_from 0.0.0.0/0; with the actual trusted proxy CIDR (e.g., 172.17.0.0/16 for docker bridge network, or your specific ingress/proxy subnet):
- set_real_ip_from 0.0.0.0/0;
+ set_real_ip_from <trusted_proxy_cidr>;
real_ip_recursive on;
real_ip_header X-Forwarded-For;🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@apps/admin/nginx/nginx.conf` around lines 12 - 15, The nginx configs
currently set_real_ip_from 0.0.0.0/0 which trusts all proxies and allows
X-Forwarded-For spoofing; replace the set_real_ip_from entry in the nginx blocks
(the set_real_ip_from directive paired with real_ip_header X-Forwarded-For and
real_ip_recursive on) in apps/admin/nginx/nginx.conf, apps/web/nginx/nginx.conf
and apps/space/nginx/nginx.conf with your trusted proxy CIDR (for docker-compose
use the docker bridge like 172.17.0.0/16 or your ingress subnet) and ensure the
same CIDR is applied consistently across all three files; if your deployment
uses multiple proxy subnets, add multiple set_real_ip_from lines for each
trusted CIDR.
| set_real_ip_from 0.0.0.0/0; | ||
| real_ip_recursive on; | ||
| real_ip_header X-Forward-For; | ||
| real_ip_header X-Forwarded-For; | ||
| limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s; |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n apps/space/nginx/nginx.conf | head -30Repository: makeplane/plane
Length of output: 817
Restrict set_real_ip_from to only trusted sources to prevent IP spoofing.
Line 12's 0.0.0.0/0 allows any source to spoof the X-Forwarded-For header (line 14), bypassing rate limiting on line 15 and any IP-based security controls. Narrow this to only your ingress controller or load balancer CIDR (e.g., 10.0.0.0/8, 172.16.0.0/12, or a specific IP).
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@apps/space/nginx/nginx.conf` around lines 12 - 15, The configuration
currently sets set_real_ip_from to 0.0.0.0/0 which allows any client to claim an
X-Forwarded-For address and can bypass IP-based controls; change the
set_real_ip_from directive(s) to only include your trusted ingress/load-balancer
CIDR(s) or specific IP(s) (e.g., your cluster LB CIDR like 10.0.0.0/8 or the
specific load balancer IP) so real_ip_header (X-Forwarded-For) is only trusted
from those sources and rate limiting in limit_req_zone against
$binary_remote_addr and zone=mylimit cannot be spoofed.
| set_real_ip_from 0.0.0.0/0; | ||
| real_ip_recursive on; | ||
| real_ip_header X-Forward-For; | ||
| real_ip_header X-Forwarded-For; | ||
| limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s; |
There was a problem hiding this comment.
Same trust-boundary issue exists here with real IP handling.
Line 12 (set_real_ip_from 0.0.0.0/0) is overly permissive. Combined with Line 14 (X-Forwarded-For), this can allow forged client IPs unless only trusted proxy networks can reach this service.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@apps/web/nginx/nginx.conf` around lines 12 - 15, The real IP configuration is
too permissive: replace the broad set_real_ip_from 0.0.0.0/0 with only your
trusted proxy CIDR(s) (e.g., the load balancer or CDN networks) so
real_ip_header X-Forwarded-For is only trusted from those sources; update
set_real_ip_from entries accordingly (or remove the directive if no trusted
proxies exist) to prevent forged client IPs affecting limit_req_zone
$binary_remote_addr and related rate-limiting logic.
|
This PR #8935 already resolves this. |
3 participants
Summary
Fixes a typo in the nginx
real_ip_headerdirective across the web, admin, and space nginx configs.Changes
X-Forward-Forwith the standardX-Forwarded-Forheader.apps/webapps/adminapps/spaceWhy
X-Forward-Foris not a standard HTTP header. UsingX-Forwarded-Forallows nginx to resolve the real client IP correctly when Plane is deployed behind a proxy or load balancer.Related Issue
Closes #8934
Summary by CodeRabbit