Browse Source

fix(api): fix django source of remote IP

In accordance with the nginx default uwsgi parameters, we cannot
trust the X-Forwarded-For HTTP header field. However, nxing uwsgi
parameters guarantee that the uwsgi REMOTE_ADDR field contains
the IP that is talking to nginx.

State prior to this commit compromise the abuse checks that are
conducted relying on the remote IP address.

This closes nils-wisiol/desec-internal#8.
Nils Wisiol 8 years ago
parent
commit
ecee5025f3
1 changed files with 1 additions and 6 deletions
  1. 1 6
      api/desecapi/views.py

+ 1 - 6
api/desecapi/views.py

@@ -29,12 +29,7 @@ from desecapi.emails import send_account_lock_email
 
 
 def get_client_ip(request):
-    x_forwarded_for = request.META.get('HTTP_X_FORWARDED_FOR')
-    if x_forwarded_for:
-        ip = x_forwarded_for.split(',')[0]
-    else:
-        ip = request.META.get('REMOTE_ADDR')
-    return ip
+    return request.META.get('REMOTE_ADDR')
 
 
 class DomainList(generics.ListCreateAPIView):