~bigbes/core-go

1c4d7007b5eefe32d6a4e39b56e6563ba50c2e34 — Conrad Hoffmann 1 year, 21 days ago a851605 
auth: fix remote IP determination for audit log

This is probably isolated to dev or other small environments, but I had
two issues with the remote IP determination, breaking the audit log
display in my dev env after fairly standard usage.

The gist is that the audit log is designed to contain clean IP addresses
only. However, the algorithm starts out with `r.RemoteAddr`, which may
contain a port (usually 127.0.0.1:xxxxx). The port removal is already
performed at the beginning of the function, so simply re-use the result
of this.

Furthermore, the initial value (containing the port leading to breakage)
landed in the audit log because I was using a private IP (it's my dev
evn). We correctly trust private IPs, but that means if no public IP
ever shows up in the X-Forwarded-For header, the last private IP was the
one that actually made the request.

I am not entirely sure why this showed up now. I already had a bunch of
oder audit log entries that had the correct private-but-not-localhost
addresses. But in the current state, e.g. simply updating my profile
would cause the bad IP:port notation to be written to the audit log.
patch browse .tar.gz .zip 
1 files changed, 2 insertions(+), 2 deletions(-)

M auth/middleware.go

M auth/middleware.go => auth/middleware.go +2 -2
@@ 299,7 299,7 @@ func internalAuth(payload []byte, w http.ResponseWriter, r *http.Request, next h
	auth.InternalAuth = internalAuth
	auth.Grants, _ = DecodeGrants(r.Context(), "")

	auth.IPAddress = r.RemoteAddr
	auth.IPAddress = host
	var route []string
	for _, val := range r.Header.Values("X-Forwarded-For") {
		route = append(route, strings.Split(val, ",")...)


@@ 309,10 309,10 @@ func internalAuth(payload []byte, w http.ResponseWriter, r *http.Request, next h
		if ip == nil {
			continue
		}
		auth.IPAddress = ip.String()
		if ip.IsPrivate() {
			continue
		}
		auth.IPAddress = ip.String()
		break
	}