github/dokku
0
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

feat: configure trust x-forwarded-for headers via nginx:set iso trust by default, refs #4339

Browse Source
This commit is contained in:
Bjorn Post
2021-01-18 21:09:00 +01:00
parent 2cdfa1cae1
commit 7cd6f7666c
3 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
plugins/nginx-vhosts/functions
View File

@@ -462,6 +462,8 @@ nginx_build_config() {
local NGINX_BIND_ADDRESS_IP6="$(fn-plugin-property-get-default "nginx" "$APP" "bind-address-ipv6" "::")"
[[ -z "$NGINX_BIND_ADDRESS_IP6" ]] && NGINX_BIND_ADDRESS_IP6="::"
local PROXY_TRUST_X_FORWARDED_FOR="$(fn-plugin-property-get-default "nginx" "$APP" "trust-x-forwarded-for" "false")"
eval "$(config_export app "$APP")"
local SIGIL_PARAMS=(-f "$NGINX_TEMPLATE" APP="$APP" DOKKU_ROOT="$DOKKU_ROOT"
NOSSL_SERVER_NAME="$NOSSL_SERVER_NAME"
@@ -490,7 +492,8 @@ nginx_build_config() {
# Deprecated: Remove this after a few versions
NGINX_PORT="$PROXY_PORT" NGINX_SSL_PORT="$PROXY_SSL_PORT"
PROXY_PORT="$PROXY_PORT" PROXY_SSL_PORT="$PROXY_SSL_PORT" RAW_TCP_PORTS="$RAW_TCP_PORTS"
PROXY_PORT_MAP="$PROXY_PORT_MAP" PROXY_UPSTREAM_PORTS="$PROXY_UPSTREAM_PORTS")
PROXY_PORT_MAP="$PROXY_PORT_MAP" PROXY_UPSTREAM_PORTS="$PROXY_UPSTREAM_PORTS"
PROXY_TRUST_X_FORWARDED_FOR="$PROXY_TRUST_X_FORWARDED_FOR")
local DOKKU_SCALE_FILE="$DOKKU_ROOT/$APP/DOKKU_SCALE"
while read -r line || [[ -n "$line" ]]; do

4
plugins/nginx-vhosts/templates/nginx.conf.sigil
View File

@@ -34,7 +34,7 @@ server {
proxy_set_header Connection $http_connection;
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-For {{ if $.PROXY_TRUST_X_FORWARDED_FOR eq "true" }}$proxy_add_x_forwarded_for{{ else }}$remote_addr{{ end }};
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Request-Start $msec;
}
@@ -97,7 +97,7 @@ server {
proxy_set_header Connection $http_connection;
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-For {{ if $.PROXY_TRUST_X_FORWARDED_FOR eq "true" }}$proxy_add_x_forwarded_for{{ else }}$remote_addr{{ end }};
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Request-Start $msec;
}