sneak/webhooker
1
0
Fork 0
Code Issues 63 Pull Requests 6 Actions 4 Packages Projects Releases Wiki Activity

Trust the RFC 1918 ranges as proxies when TRUSTED_PROXIES is unset (closes #333) #336

Open
clawbot wants to merge 3 commits from issue-333-trust-rfc1918-proxies into next
pull from: issue-333-trust-rfc1918-proxies
merge into: :next
Conversation 5 Commits 3 Files Changed 10
+4 -3
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 3050c2e3b5 - Show all commits
README.md
+4 -3
View File
@@ -2722,9 +2722,10 @@ re-fills both verification slots on its first two requests. The
remedies are to block the source at the reverse proxy, or to
rate-limit `POST /pages/login` there — the one place a limit can be
applied without reintroducing the lockout, because the proxy sees the
real client address. `TRUSTED_PROXIES` does not stop the saturation,
but when it covers the proxy the source is visible in the failure logs,
and the default covers a proxy on a private network.
real client address. `TRUSTED_PROXIES` does not stop the saturation.
The flood's source is in the proxy's access log: webhooker's own logs
record the proxy's address, not the client's (see
[Deployment behind a reverse proxy](#deployment-behind-a-reverse-proxy)).
Finer-grained per-webhook rate limits (configured in the web UI and
enforced in the webhook handler) can layer on top of this env-level