PapaTramp
80320ae698
Close audit findings: anti-spoof client IP for login rate limit, JWT/CORS enforce on startup, SSH host-key verification and sudo via stdin, optional WinRM HTTPS, SSE httpOnly cookie auth, ingest body limit, ILIKE escaping, and HMAC API key hashing with legacy SHA-256 fallback.
28 lines
868 B
Python
28 lines
868 B
Python
"""Resolve client IP behind reverse proxy (nginx $proxy_add_x_forwarded_for)."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from fastapi import Request
|
|
|
|
|
|
def client_ip_from_request(request: Request) -> str:
|
|
"""Client IP for rate limiting.
|
|
|
|
nginx with ``proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for``
|
|
appends the real peer address as the *last* hop. Spoofed values in the
|
|
incoming header therefore cannot replace the actual client IP.
|
|
"""
|
|
if request.client and request.client.host:
|
|
direct = request.client.host.strip()
|
|
else:
|
|
direct = "unknown"
|
|
|
|
forwarded = (request.headers.get("x-forwarded-for") or "").strip()
|
|
if not forwarded:
|
|
return direct[:64]
|
|
|
|
parts = [part.strip() for part in forwarded.split(",") if part.strip()]
|
|
if not parts:
|
|
return direct[:64]
|
|
return parts[-1][:64]
|