git.iko.soy/typeable/oauth2-proxy
on master help sign in
feat: add CF-Connecting-IP as supported real ip header (#2821)
commit3ceef0cff4b7e9d4ff91b7437e07c2db9c98f91a authorOndrej Sika <ondrej@ondrejsika.com> dateMon 4 Nov 2024, 23:28 (2 years ago) parent64e736f
5 files changed+7−3
compare with master
unifiedsplit
CHANGELOG.md+1 docs/docs/configuration/overview.md+1−1 pkg/apis/options/options.go+1−1 pkg/ip/realclientip.go+3−1 pkg/ip/realclientip_test.go+1
CHANGELOG.md+1
@@ -12,6 +12,7 @@
1212- [#2755](https://github.com/oauth2-proxy/oauth2-proxy/pull/2755) feat: add X-Envoy-External-Address as supported header (@bjencks)
1313- [#1985](https://github.com/oauth2-proxy/oauth2-proxy/pull/1985) Add support for systemd socket (@isodude)
1414- [#2300](https://github.com/oauth2-proxy/oauth2-proxy/pull/2300) Add fix for websocket path rewrite (@rekup)
15+- [#2821](https://github.com/oauth2-proxy/oauth2-proxy/pull/2821) feat: add CF-Connecting-IP as supported real ip header
1516
1617# V7.7.1
1718
docs/docs/configuration/overview.md+1−1
@@ -199,7 +199,7 @@ Provider specific options can be found on their respective subpages.
199199| flag: `--htpasswd-file`<br/>toml: `htpasswd_file` | string | additionally authenticate against a htpasswd file. Entries must be created with `htpasswd -B` for bcrypt encryption | |
200200| flag: `--htpasswd-user-group`<br/>toml: `htpasswd_user_groups` | string \| list | the groups to be set on sessions for htpasswd users | |
201201| flag: `--proxy-prefix`<br/>toml: `proxy_prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
202−| flag: `--real-client-ip-header`<br/>toml: `real_client_ip_header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, X-ProxyUser-IP, or X-Envoy-External-Address) | X-Real-IP |
202+| flag: `--real-client-ip-header`<br/>toml: `real_client_ip_header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, X-ProxyUser-IP, X-Envoy-External-Address, or CF-Connecting-IP) | X-Real-IP |
203203| flag: `--redirect-url`<br/>toml: `redirect_url` | string | the OAuth Redirect URL, e.g. `"https://internalapp.yourcompany.com/oauth2/callback"` | |
204204| flag: `--relative-redirect-url`<br/>toml: `relative_redirect_url` | bool | allow relative OAuth Redirect URL.` | false |
205205| flag: `--reverse-proxy`<br/>toml: `reverse_proxy` | bool | are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-\{Proto,Host,Uri\} headers to be used on redirect selection | false |
pkg/apis/options/options.go+1−1
@@ -116,7 +116,7 @@ func NewFlagSet() *pflag.FlagSet {
116116 flagSet := pflag.NewFlagSet("oauth2-proxy", pflag.ExitOnError)
117117
118118 flagSet.Bool("reverse-proxy", false, "are we running behind a reverse proxy, controls whether headers like X-Real-Ip are accepted")
119− flagSet.String("real-client-ip-header", "X-Real-IP", "Header used to determine the real IP of the client (one of: X-Forwarded-For, X-Real-IP, X-ProxyUser-IP, or X-Envoy-External-Address)")
119+ flagSet.String("real-client-ip-header", "X-Real-IP", "Header used to determine the real IP of the client (one of: X-Forwarded-For, X-Real-IP, X-ProxyUser-IP, X-Envoy-External-Address, or CF-Connecting-IP)")
120120 flagSet.StringSlice("trusted-ip", []string{}, "list of IPs or CIDR ranges to allow to bypass authentication. WARNING: trusting by IP has inherent security flaws, read the configuration documentation for more information.")
121121 flagSet.Bool("force-https", false, "force HTTPS redirect for HTTP requests")
122122 flagSet.String("redirect-url", "", "the OAuth Redirect URL. ie: \"https://internalapp.yourcompany.com/oauth2/callback\"")
pkg/ip/realclientip.go+3−1
@@ -16,7 +16,9 @@ func GetRealClientIPParser(headerKey string) (ipapi.RealClientIPParser, error) {
1616 case http.CanonicalHeaderKey("X-Forwarded-For"),
1717 http.CanonicalHeaderKey("X-Real-IP"),
1818 http.CanonicalHeaderKey("X-ProxyUser-IP"),
19− http.CanonicalHeaderKey("X-Envoy-External-Address"):
19+ http.CanonicalHeaderKey("X-Envoy-External-Address"),
20+ // Cloudflare specific Real-IP header
21+ http.CanonicalHeaderKey("CF-Connecting-IP"):
2022 return &xForwardedForClientIPParser{header: headerKey}, nil
2123 }
2224
pkg/ip/realclientip_test.go+1
@@ -22,6 +22,7 @@ func TestGetRealClientIPParser(t *testing.T) {
2222 {"X-REAL-IP", "", forwardedForType},
2323 {"x-proxyuser-ip", "", forwardedForType},
2424 {"x-envoy-external-address", "", forwardedForType},
25+ {"cf-connecting-ip", "", forwardedForType},
2526 {"", "the http header key () is either invalid or unsupported", nil},
2627 {"Forwarded", "the http header key (Forwarded) is either invalid or unsupported", nil},
2728 {"2#* @##$$:kd", "the http header key (2#* @##$$:kd) is either invalid or unsupported", nil},