Security risks of the default settings about django-ipware HOT 3 CLOSED

The purpose of this module is to make the best attempt to find the private or a routable IP address of the client while keeping it DRY, and acknowledging that IP addresses can be spoofed and there is no way to avoid that.

The security of no web-stack should rely on this module and If ipware is used with the security mindset, then IPWARE_META_PRECEDENCE_ORDER should be overwritten as per specific setup requirements.

from django-ipware.

The security of no web-stack should rely on this module

Agreed.

I would opt to mention this clearly in the README. The default just works, but no more then unpacking a wifi router and use it without reading instructions.

from django-ipware.

I would appreciate a pull request where a Notice is added to the README file regarding the security implication of the default behavior. I'll include it in the next release cycle.

from django-ipware.