realip_remote_addr behavior easily leads to insecure code
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
- Issue type
- Bug
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- rust
- Domain
- backend-api-design, security
Research direction
Start with the linked ConnectionInfo::realip_remote_addr documentation and compare its behavior with remote_addr and host. Review Werkzeug's linked ProxyFix middleware for its opt-in proxy and trusted-proxy handling. Done should include a settled configuration/API direction, coverage for direct and proxied requests, and documentation that makes unsafe unconditional use clear.
Written by the indexing model from the issue text.
Description
https://docs.rs/actix-web/3.3.2/actix_web/dev/struct.ConnectionInfo.html#method.realip_remote_addr
This means that you have to use different functions depending on whether the application is behind a reverse proxy or not. But you tpyically do not want to recompile an application for something like this.
It would be much better if there was a config option indicating that the application is behind a proxy, and in that case have remote_addr return the correct one.
Realistically, there's a good chance that applications just use realip_remote_addr unconditionally, making it vulnerable to IP spoofing when it's not running behind a reverse proxy.
FWIW, the host logic seems to be similarly broken, since you can most likely pass a "bad" host header to an application if it's not behind a reverse proxy or that proxy does not filter out all the header this create uses.
FWIW, I recommend looking at how the ProxyFix middleware for the werkzeug Python web framework is implemented. It's opt-in, and lets you specify which proxy adds the data you want (in case of multiple proxies all adding to the headers).
- Dominant language
- Rust
- Stars
- 24.9k
- Forks
- 2k
- Avg merge
- 19h 9m
- Merged PRs (30d)
- 61
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from actix/actix-web
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
[actix-multipart] Generic "Payload error" when request exceeds size limitPossibly taken @robjtede claimed this 47 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
actix/actix-web#4168 · 4 comments · 1 assignee ·
Maintainers usually reply within 1 day
-
Change `HttpRequest::content_type` to return `Option<&str>`Possibly taken @Sruhvx-jpg claimed this 65 days ago. OpenA-http
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
actix/actix-web#3797 · 1 comment ·
Maintainers usually reply within 1 day
-
A-web C-improvement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
actix/actix-web#2666 · 4 comments · 2 reactions ·
Maintainers usually reply within 1 day
-
A-http A-web
Difficulty 4/5 3-5 days Newbie friendliness 20/100
Maintainers usually reply within 1 day
Similar issues
-
bug CLI exec session
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
compatibility
Difficulty 1/5 Under an hour Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
aws/aws-emulator#30 · 1 comment ·
-
tormach-plasma refusal text with no machine reads "no machine is not declared a plasma machine"Openarea:post bug effort:low P2 source:agent
Difficulty 1/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
Higher Interval Candles draws nothing on a seconds chart whose interval does not divide two hoursOpenbug studies
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
userFRM/egui-charts#2727 ·
Maintainers usually reply within 1 day