Tickets :: Comment on [#6133] don't blindly trust x-forwarded-for

* Your Email Address
* Spam protection	Enter the letters below: . .\ /.__ .__ . . \| \| >< [__)\| \\|\ \| \|/\\|/ \\| \|__/\| \\|
Comment	> there are some places in horde where X-Forwarded-For header is used > for specifying IP the connection came from. The X-Forwarded-For is > provided by client that can send anything and it will be used. > > This results in e.g. mail headers containing internal IP's > unreachable from server telling nothing to the admin. > > > > Please make usage of X-Forwarded-For optional. The best solution > allowing to trust some (e.g. own) proxies would be to have list of > trusted proxies and check REMOTE_ADDR and HTTP_X_FORWARDED_FOR (from > last to first) if they match trusted proxy and use the fuirst > untrusted IP in the list. > >
Attachment
Watch this ticket