watson/umami
1
0
Fork 0
mirror of https://github.com/umami-software/umami.git synced 2026-02-04 04:37:11 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge pull request #3613 from nickcmaynard/fix-ip-header-ordering

Browse source 
Fix ordering to allow X-Forwarded-For to be correctly managed by Cloudflare
This commit is contained in:
Mike Cao 2025-09-16 20:57:20 -07:00 • committed by GitHub
commit aa398201be
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 15 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/lib/__tests__/detect.test.ts
View file

@ -2,6 +2,7 @@ import * as detect from '../detect';
import { expect } from '@jest/globals'; import { expect } from '@jest/globals';
const IP = '127.0.0.1'; const IP = '127.0.0.1';
const BAD_IP = '127.127.127.127';
test('getIpAddress: Custom header', () => { test('getIpAddress: Custom header', () => {
process.env.CLIENT_IP_HEADER = 'x-custom-ip-header'; process.env.CLIENT_IP_HEADER = 'x-custom-ip-header';
@ -17,6 +18,12 @@ test('getIpAddress: Standard header', () => {
expect(detect.getIpAddress(new Headers({ 'x-forwarded-for': IP }))).toEqual(IP); expect(detect.getIpAddress(new Headers({ 'x-forwarded-for': IP }))).toEqual(IP);
}); });
test('getIpAddress: CloudFlare header is lower priority than standard header', () => {
expect(
detect.getIpAddress(new Headers({ 'cf-connecting-ip': BAD_IP, 'x-forwarded-for': IP })),
).toEqual(IP);
});
test('getIpAddress: No header', () => { test('getIpAddress: No header', () => {
expect(detect.getIpAddress(new Headers())).toEqual(null); expect(detect.getIpAddress(new Headers())).toEqual(null);
}); });

13
src/lib/constants.ts
View file

@ -333,17 +333,20 @@ export const BROWSERS = {
yandexbrowser: 'Yandex', yandexbrowser: 'Yandex',
}; };
// The order here is important and influences how IPs are detected by lib/detect.ts
// Please do not change the order unless you know exactly what you're doing - read https://developers.cloudflare.com/fundamentals/reference/http-headers/
export const IP_ADDRESS_HEADERS = [ export const IP_ADDRESS_HEADERS = [
'cf-connecting-ip', 'x-client-ip',
'x-forwarded-for',
'cf-connecting-ip', // This should be *after* x-forwarded-for, so that x-forwarded-for is respected if present
'do-connecting-ip', 'do-connecting-ip',
'fastly-client-ip', 'fastly-client-ip',
'forwarded',
'true-client-ip', 'true-client-ip',
'x-appengine-user-ip', 'x-real-ip',
'x-client-ip',
'x-cluster-client-ip', 'x-cluster-client-ip',
'x-forwarded', 'x-forwarded',
'x-forwarded-for', 'forwarded',
'x-appengine-user-ip',
'x-nf-client-connection-ip', 'x-nf-client-connection-ip',
'x-real-ip', 'x-real-ip',
]; ];