Django

Code

Ticket #3872 (closed: fixed)

Opened 2 years ago

Last modified 1 year ago

Bug in SetRemoteAddrFromForwardedFor middleware

Reported by: Simon Willison Assigned to: gregorth
Milestone: Component: Core framework
Version: SVN Keywords: middleware
Cc: Triage Stage: Ready for checkin
Has patch: 1 Needs documentation: 0
Needs tests: 0 Patch needs improvement: 0

Description

The middleware contains the following: 

# HTTP_X_FORWARDED_FOR can be a comma-separated list of IPs.
# Take just the first one.
real_ip = real_ip.split(",")[0]

I'm pretty sure it should be taking the LAST element in the list, not the first - at least going by Bob Ippolito's description here:

http://bob.pythonmac.org/archives/2005/09/23/apache-x-forwarded-for-caveat/

This could be a security issue, as it may allow people to forge an X-Forwarded-For header and provide a fake IP address to Django.

Attachments

SetRemoteAddrFromForwardedFor.diff (0.6 kB) - added by gregorth on 09/14/07 15:59:39.
patch against revision 6213

Change History

03/29/07 23:16:51 changed by Gary Wilson <gary.wilson@gmail.com>

  • needs_better_patch changed.
  • stage changed from Unreviewed to Accepted.
  • needs_tests changed.
  • needs_docs changed.

Marking accepted unless someone can prove otherwise.

09/14/07 13:29:33 changed by gregorth

  • owner changed from nobody to gregorth.
  • status changed from new to assigned.

09/14/07 15:59:39 changed by gregorth

  • attachment SetRemoteAddrFromForwardedFor.diff added.

patch against revision 6213

09/14/07 16:00:23 changed by gregorth

  • has_patch set to 1.

09/14/07 16:42:28 changed by gregorth

  • stage changed from Accepted to Ready for checkin.

09/16/07 11:54:16 changed by adrian

  • status changed from assigned to closed.
  • resolution set to fixed.

(In [6364]) Fixed #3872 -- Fixed incorrect handling of HTTP_X_FORWARDED_FOR in SetRemoteAddrFromForwardedFor?. Thanks, Simon Willison and gregorth

09/18/07 14:01:34 changed by Chris Bennett <chrisrbennett@yahoo.com>

  • status changed from closed to reopened.
  • resolution deleted.

Wait a minute... client IS the first IP listed. http://en.wikipedia.org/wiki/X-Forwarded-For

And I'm looking at request on a machine being proxied by Apache right now: HTTP_X_FORWARDED_FOR: 66.162.32.x, 127.0.0.1

Also, some reverse proxies may pass X-Forwarded-For and its capitalization variants in place of HTTP_X_FORWARDED_FOR.

Though, in either case, the origin client is clearly first. Revert?

09/20/07 12:03:14 changed by jacob

  • status changed from reopened to closed.
  • resolution set to fixed.

(In [6397]) Fixed #3872, which turns out to not have been a bug in the first place, by reverting [6364].

09/20/07 12:11:23 changed by leosoto <leo.soto@gmail.com>

Jacob: please consider my comments on http://groups.google.com/group/django-developers/browse_thread/thread/b3b2deb687a3e885

Add/Change #3872 (Bug in SetRemoteAddrFromForwardedFor middleware)




Change Properties
Action