Add ::1 to default forwarded-allow-ips

Checklist

• The bug is reproducible against the latest release and/or master.
• There are no similar issues or pull requests to fix it yet.

Describe the bug

--forwarded-allow-ips currently defaults to 127.0.0.1. It should default to ::1,127.0.0.1 as it’s the year 2021.

To reproduce

Inspect the request object with the default --forwarded-allow-ips.

Expected behavior

For --forwarded-allow-ips to default to ::1,127.0.0.1.

Actual behavior

--forwarded-allow-ips defaults to 127.0.0.1.

Debugging material

None.

Environment

• OS / Python / Uvicorn version: just run uvicorn --version Running uvicorn 0.12.3 with CPython 3.7.3 on Linux

• The exact command you’re running uvicorn with, all flags you passed included. If you run it with gunicorn please do the same. If there is a reverse-proxy involved and you cannot reproduce without it please give the minimal config of it to reproduce. /opt/clusterapi/bin/python3.7 /opt/clusterapi/bin/uvicorn --host :: --port 5000 app.main:app --workers 9 --proxy-headers

Additional context

None.

[euri10]

–forwarded-allow-ips currently defaults to 127.0.0.1. It should default to ::1,127.0.0.1 as it’s the year 2021.

most server I’m familiar with use ipv4 for the proxy headers defaults, at least gunicorn I’m pretty sure of it. is there a good argument appart from it’s the year 2021 ? happy to re-open of course if there is !

[WilliamDEdwards]

iirc you could bypass ipv4 firewalls with ipv6 traffic, that may be old but this was not a bad idea at all On Fri, Nov 19, 2021 at 2:33 PM William Edwards @.> wrote: … I do that on all my boxes, dunno if it is common or not, but the most sensible default is imho that we’re sure that ipv4 is enabled. Curious about what others may think about this 😃 … <#m_-5475762193031936881_> On Fri, Nov 19, 2021 at 2:28 PM William Edwards @.> wrote: what if the box you’re on doesnt have ipv6 enabled ? the sensible default becomes less sensible That means the user would’ve had to gone out of their way to explicitly disable IPv6 using sysctl. I don’t think that’s common. — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub, or unsubscribe. OT: It doesn’t hurt to have IPv6 enabled. Even if you don’t configure an IPv6 address yourself. Setting net.ipv6.conf.all.disable_ipv6=0 or similar is a bad idea, end of story. — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub <#1245 (comment)>, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAINSPWOBT3H3W4O6QHDNL3UMZG25ANCNFSM5HYFKAYA .

How are you going to receive external, firewallable traffic on a loopback interface? Or disable SLAAC.