hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

RemoteIp: only trust X-Forwarded-For

Browse source 
Our nginx config will happily pass `Forwarded`/`X-Real-IP` from the
client. Caddy, Apache and Varnish pass `X-Forwarded-For` as well anyway.
This commit is contained in:
rinpatch 2020-01-29 23:59:27 +03:00
commit 889965141a
2 changed files with 3 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

3
lib/pleroma/plugs/remote_ip.ex
View file

@ -10,10 +10,7 @@ defmodule Pleroma.Plugs.RemoteIp do
@behaviour Plug
@headers ~w[
forwarded
x-forwarded-for
x-client-ip
x-real-ip
]
# https://en.wikipedia.org/wiki/Localhost