x-forwarded-host improvements.
Ylian Saint-Hilaire committed
Nov 28, 2020 at 19:30 UTC
de31acf94094106360e7b65e6fd061c732521b53
1 file changed
+10
-6
webserver.js
+10
-6
@@ -4853,13 +4853,14 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4853
obj.app.use(function (req, res, next) {
4854
// Set the real IP address of the request
4855
// If a trusted reverse-proxy is sending us the remote IP address, use it.
4856
- var ipex = '0.0.0.0';
4857
- if (typeof req.ip == 'string') { ipex = (req.ip.startsWith('::ffff:')) ? req.ip.substring(7) : req.ip; }
4856
+ var ipex = '0.0.0.0', serverHost = req.headers.host;
4857
+ if (typeof req.connection.remoteAddress == 'string') { ipex = (req.connection.remoteAddress.startsWith('::ffff:')) ? req.connection.remoteAddress.substring(7) : req.connection.remoteAddress; }
4858
if (
4859
(obj.args.trustedproxy === true) ||
4860
((typeof obj.args.trustedproxy == 'object') && (obj.args.trustedproxy.indexOf(ipex) >= 0)) ||
4861
((typeof obj.args.tlsoffload == 'object') && (obj.args.tlsoffload.indexOf(ipex) >= 0))
4862
) {
4863
+ // Get client IP
4864
if (req.headers['cf-connecting-ip']) { // Use CloudFlare IP address if present
4865
req.clientIp = req.headers['cf-connecting-ip'].split(',')[0].trim();
4866
} else if (req.headers['x-forwarded-for']) {
@@ -4869,6 +4870,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4870
} else {
4871
req.clientIp = ipex;
4872
}
4873
+
4874
+ // Get server host
4875
+ if (req.headers['x-forwarded-host']) { serverHost = req.headers['x-forwarded-host']; }
4876
} else {
4877
req.clientIp = ipex;
4878
}
@@ -4887,9 +4891,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4891
res.set(domain.httpheaders);
4892
} else {
4893
// Use default security headers
4890
- var geourl = (domain.geolocation ? ' *.openstreetmap.org' : '');
4891
- var selfurl = req.headers['x-forwarded-host'] ? (' wss://' + req.headers['x-forwarded-host']) : (' wss://' + req.headers.host);
4892
- var headers = {
4894
+ const geourl = (domain.geolocation ? ' *.openstreetmap.org' : '');
4895
+ const selfurl = ' wss://' + serverHost;
4896
+ const headers = {
4897
'Referrer-Policy': 'no-referrer',
4898
'X-XSS-Protection': '1; mode=block',
4899
'X-Content-Type-Options': 'nosniff',
@@ -4928,7 +4932,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4932
// Set the real IP address of the request
4933
// If a trusted reverse-proxy is sending us the remote IP address, use it.
4934
var ipex = '0.0.0.0';
4931
- if (typeof req.ip == 'string') { ipex = (req.ip.startsWith('::ffff:')) ? req.ip.substring(7) : req.ip; }
4935
+ if (typeof req.connection.remoteAddress == 'string') { ipex = (req.connection.remoteAddress.startsWith('::ffff:')) ? req.connection.remoteAddress.substring(7) : req.connection.remoteAddress; }
4936
if (
4937
(obj.args.trustedproxy === true) ||
4938
((typeof obj.args.trustedproxy == 'object') && (obj.args.trustedproxy.indexOf(ipex) >= 0)) ||