Use ProxyFix instead of inspecting X-Forwarded-For header

[lnielsen]

PR #352 fixed a security issue in extracting a correct remote IP address from X-Forwarded-For header.

The fix however doesn't take multiple trusted proxies into account, which you typically have in a load balanced setup (e.g. HAProxy + Nginx). The problem is located here, and can quickly be demonstrated with this example where it's always the last address in X-Forwarded-For being chosen:

>>> x_forwarded_for = '33.33.33.33, 22.22.22.22, 11.11.11.11'
>>> x_forwarded_for.rpartition(' ')[-1]
'11.11.11.11'

The problem with the current code is that if you use ProxyFix to set a correct IP address in request.remote_addr, then Flask-Security doesn't pick it up because X-Forwarded-For headers are inspected first. The workaround so far, is in addition to ProxyFix to use HeaderRewriterFix to remove the X-Forwarded-For headers completely from the request.

Proposal

IMHO, Flask-Security (and any other Flask extension for that matter) should rely solely on request.remote_addr to get the client IP address, and only document that you should use ProxyFix in order to ensure that remote_addr is set correctly (already done in Flask-Security).

[coveralls]

Coverage decreased (-0.009%) to 94.274% when pulling bfcb8ab8d59033dc40a072f12394c380d00338b0 on lnielsen:feature-xforwardedfor-removal into 9e5865d on mattupstate:develop.

[coveralls]

Coverage decreased (-0.009%) to 94.274% when pulling 0676c29 on lnielsen:feature-xforwardedfor-removal into 9e5865d on mattupstate:develop.

[coveralls]

Coverage decreased (-0.009%) to 94.274% when pulling 0676c29 on lnielsen:feature-xforwardedfor-removal into 9e5865d on mattupstate:develop.

[lnielsen]

PyPy build is failing probably due to latest peewee release (2.8.2 release on Aug 9)

[mattupstate]

This is great. Thanks for this. Are you able to rebase off of develop and get the build passing?

[jirikuncar]

Merged as 0676c29 via #617.