NikolajDanger/wiki-tcg
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

🐐 comments

Browse Source
This commit is contained in:
NikolajDanger
2026-07-29 16:49:15 +02:00
parent c56498239f
commit 30af2b84ad
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/core/dependencies.py
+6 -4
View File
@@ -39,11 +39,13 @@ def get_client_ip(conn: Request | WebSocket) -> str:
NPM sets X-Forwarded-For to $proxy_add_x_forwarded_for, which *appends* the peer NPM sets X-Forwarded-For to $proxy_add_x_forwarded_for, which *appends* the peer
it saw to whatever the client sent. So the last entry is always written by NPM and it saw to whatever the client sent. So the last entry is always written by NPM and
anything a client forges lands to its left — take the rightmost, never the first. anything a client forges lands to its left. Take the rightmost, never the first.
This trusts the header because NPM is the only way in: port 8000 is unpublished and This trusts the header because port 8000 is not published: the only things that can
the backend only shares the `proxy` network with NPM. If a port is ever published, reach it are containers sharing a network with this one: NPM and the frontend on
or another container is put on `proxy`, this becomes forgeable and needs revisiting. `proxy`, and the database on `tcg-internal`. All three are trusted by topology. If a
port is ever published, or an untrusted container joins either network, the header
becomes forgeable and this needs revisiting.
""" """
forwarded = conn.headers.get("x-forwarded-for") forwarded = conn.headers.get("x-forwarded-for")
if forwarded: if forwarded: