Talon/chat_grid
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Harden forwarded IP parsing for auth throttling

Browse Source
This commit is contained in:
Jage9
2026-03-02 00:41:58 -05:00
parent 26d6bafce0
commit 873b00e070
2 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
server/app/server.py
View File

@@ -481,7 +481,10 @@ class SignalingServer:
forwarded = str(headers.get("X-Forwarded-For", "")).strip() forwarded = str(headers.get("X-Forwarded-For", "")).strip()
if not forwarded: if not forwarded:
return peer_ip return peer_ip
for candidate in forwarded.split(","): # In common reverse-proxy chains, the trusted proxy appends the immediate
# client IP to the end of X-Forwarded-For. Read right-to-left so a
# client-supplied left-side value can't spoof throttling/audit identity.
for candidate in reversed(forwarded.split(",")):
parsed = SignalingServer._normalized_ip(candidate) parsed = SignalingServer._normalized_ip(candidate)
if parsed: if parsed:
return parsed return parsed

2
server/tests/test_server_message_handling.py
View File

@@ -30,7 +30,7 @@ def test_client_ip_prefers_forwarded_for_from_loopback_proxy() -> None:
ServerConnection, ServerConnection,
SimpleNamespace( SimpleNamespace(
remote_address=("127.0.0.1", 12345), remote_address=("127.0.0.1", 12345),
request=SimpleNamespace(headers={"X-Forwarded-For": "198.51.100.25, 127.0.0.1"}), request=SimpleNamespace(headers={"X-Forwarded-For": "203.0.113.10, 198.51.100.25"}),
), ),
) )
client = ClientConnection(websocket=ws, id="u1", nickname="tester") client = ClientConnection(websocket=ws, id="u1", nickname="tester")