Comments (2)
Good idea, just two details:
- X-Forwarded-For should not be trusted by default (or a user could forge a IP), this should be chosen by the user if required, also the header should be configured, some proxies send a different header.
- This should be logged to a different file, eg. access.log, error.log is for PHP errors.
For example you could add those two constants in config:
/**
* Set to NULL to disable access log
* @var null|string
*/
const ACCESS_LOG = __DIR__ . '/access.log';
/**
* Set to the name of the trusted header containing the client IP, if behind a reverse proxy
* If set to NULL, then the connecting client IP will be used.
* @var string|null
*/
const TRUSTED_IP_HEADER = 'X-Forwarded-For';
Yes please make a PR, I don't have time to implement this sorry :)
from karadav.
Thanks for the feedback! I was also looking at SFTPGo and noticed that it has already handled some more reverse proxy setups in its configuration:
https://github.com/drakkan/sftpgo/blob/main/docs/full-configuration.md
proxy_allowed
, list of IP addresses and IP ranges allowed to set client IP proxy header such asX-Forwarded-For
. Any client IP proxy headers, if set on requests from a connection address not in this list, will be silently ignored. Default: empty.client_ip_proxy_header
, string. Defines the allowed client IP proxy header such asX-Forwarded-For
,X-Real-IP
etc. Default: emptyclient_ip_header_depth
, integer. Some client IP headers such asX-Forwarded-For
can contain multiple IP address, this setting define the position to trust starting from the right. For example if we have:10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1
and the depth is0
, SFTPGo will use13.0.0.1
as client IP, if depth is1
,12.0.0.1
will be used and so on. Default:0
.
I think I will follow this format.
from karadav.
Related Issues (20)
- Support for auth scripts? HOT 5
- Upload and other buttons missing from file management front-end HOT 2
- CORS issues with reverse-proxy HOT 2
- Installation HOT 1
- the last nexcloud cliend from f-droid crashes HOT 6
- Karadav: Option to use shared directories between users HOT 1
- docker-compose.yml HOT 3
- After update to 0.4.0 no access to web file manager, only "Invalid URL" HOT 16
- Blank page on dietpi bookworm. HOT 3
- Ah right sorry, was probably the wrong link. But there is definitly something that prevents the Android app to recognize my Karadav server, while normal WebDAV used to work fine. HOT 6
- Empty "var" folder in each user directory HOT 2
- Nextcloud client not work HOT 1
- Server replied "413 Request Entity Too Large" to PUT with Nextcloud apps on upload HOT 3
- is it possible to add X-Accel-Redirect support HOT 1
- there will be a dir name by initial account (here are "demo") left to clean if change initial usename to another HOT 1
- owncloud/nextcloud clients doesnt work if installed in sub-directory HOT 6
- 401 Error | WebDAV HOT 2
- Missing SQLite3.php in lib folder HOT 4
- Mirrored folder structure on SSD HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from karadav.