Remote IP not captured correctly

api.py uses request.remote_addr for IP logging when enabled. However, this is incorrect when behind a reverse proxy, even when the proxy attaches a header listing the “real” IP address – the remote_addr is always going to be the proxy’s IP address. Instead, the registration code needs to read something from request.headers.

As a complicating factor, matrix-registration doesn’t actually know if it’s behind a proxy. And if it’s not, it can’t trust even the last element of the X-Forwarded-For header, and should only accept the remote_addr.

There are a few possible solutions, but the approach I took was to concatenate the XFF and the remote IP, as seen in this branch: https://github.com/ZerataX/matrix-registration/compare/master...timmc:timmc/xff

            ips = ', '.join(request.headers.getlist('X-Forwarded-For') + [request.remote_addr]) \
                if config.config.ip_logging else False

…and store the (string) list of IPs instead of a single IP. (Note also the correction to the nginx config. XFF should be chained, not replaced with a single IP.)

System:

• OS: Debian 11 Bullseye
• python version: 3.9.2
• matrix registration version: 663cee1fb6a1bd40f60645d8b25480ac3994963c

[xelantro]

Btw: so just that you are aware and to link it: #83 request.remote_addr was removed and changed to request.get_remote_address So if my second statement is incorrect and you do need to append it another time, pls swap it

[timmc]

Alternatively, solve both issues by adding a config setting like CLIENT_IP_HEADER = [X-Forwarded-For | X-Real-IP | etc.] that instructs the app that there’s a trusted proxy in front – if not set, use request.remote_addr, and if set, use request.headers.getlist(config.CLIENT_IP_HEADER)[-1].