sneak/webhooker
1
0
Fork 0
Code Issues 63 Pull Requests 6 Actions 4 Packages Projects Releases Wiki Activity

Trust the RFC 1918 ranges as proxies when TRUSTED_PROXIES is unset (closes #333) #336

Open
clawbot wants to merge 3 commits from issue-333-trust-rfc1918-proxies into next
pull from: issue-333-trust-rfc1918-proxies
merge into: :next
Conversation 5 Commits 3 Files Changed 10
+4 -3
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 3050c2e3b5 - Show all commits
README.md
+4 -3
View File
@@ -2722,9 +2722,10 @@ re-fills both verification slots on its first two requests. The
remedies are to block the source at the reverse proxy, or to remedies are to block the source at the reverse proxy, or to
rate-limit `POST /pages/login` there — the one place a limit can be rate-limit `POST /pages/login` there — the one place a limit can be
applied without reintroducing the lockout, because the proxy sees the applied without reintroducing the lockout, because the proxy sees the
real client address. `TRUSTED_PROXIES` does not stop the saturation, real client address. `TRUSTED_PROXIES` does not stop the saturation.
but when it covers the proxy the source is visible in the failure logs, The flood's source is in the proxy's access log: webhooker's own logs
and the default covers a proxy on a private network. record the proxy's address, not the client's (see
[Deployment behind a reverse proxy](#deployment-behind-a-reverse-proxy)).
Finer-grained per-webhook rate limits (configured in the web UI and Finer-grained per-webhook rate limits (configured in the web UI and
enforced in the webhook handler) can layer on top of this env-level enforced in the webhook handler) can layer on top of this env-level