From 828fafe7d7d4909ebf520b394d885669dae2aedb Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Thu, 1 Oct 2026 21:02:54 +0200 Subject: [PATCH] adventurelog: remove the client-written X-Forwarded-For chain on its router (R-753) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit django-allauth 0.63.3 — leftmost XFF for its per-IP login limits. Once traefik trusts the tunnel's fixed address (controller v0.286.0), the leftmost entry is what a stranger writes; with the chain removed the app reads traefik's X-Real-Ip or its peer, as before — never forgeable. Measured on 9202: a router with this middleware receives no X-Forwarded-For (felhom.eu audits/visitors-2026-10-01/A/P1). Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS --- templates/adventurelog/docker-compose.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/templates/adventurelog/docker-compose.yml b/templates/adventurelog/docker-compose.yml index 62991ca..229470e 100644 --- a/templates/adventurelog/docker-compose.yml +++ b/templates/adventurelog/docker-compose.yml @@ -64,6 +64,10 @@ services: labels: - "traefik.enable=true" - "traefik.http.routers.adventurelog-backend.rule=Host(`${SUBDOMAIN}.${DOMAIN}`) && (PathPrefix(`/media`) || PathPrefix(`/static`) || PathPrefix(`/admin`) || PathPrefix(`/accounts`))" + # R-753: this app reads the LEFTMOST X-Forwarded-For entry, which a stranger writes once traefik keeps the + # tunnel's chain — so its chain is removed here (it then reads traefik's X-Real-Ip or peer; never forgeable). + - "traefik.http.middlewares.adventurelog-backend-xff.headers.customrequestheaders.X-Forwarded-For=" + - "traefik.http.routers.adventurelog-backend.middlewares=adventurelog-backend-xff" - "traefik.http.routers.adventurelog-backend.priority=20" - "traefik.http.routers.adventurelog-backend.entrypoints=websecure" - "traefik.http.routers.adventurelog-backend.tls=true" @@ -122,6 +126,10 @@ services: labels: - "traefik.enable=true" - "traefik.http.routers.adventurelog.rule=Host(`${SUBDOMAIN}.${DOMAIN}`)" + # R-753: this app reads the LEFTMOST X-Forwarded-For entry, which a stranger writes once traefik keeps the + # tunnel's chain — so its chain is removed here (it then reads traefik's X-Real-Ip or peer; never forgeable). + - "traefik.http.middlewares.adventurelog-xff.headers.customrequestheaders.X-Forwarded-For=" + - "traefik.http.routers.adventurelog.middlewares=adventurelog-xff" - "traefik.http.routers.adventurelog.priority=10" - "traefik.http.routers.adventurelog.entrypoints=websecure" - "traefik.http.routers.adventurelog.tls=true"