From 1c4d7007b5eefe32d6a4e39b56e6563ba50c2e34 Mon Sep 17 00:00:00 2001 From: Conrad Hoffmann Date: Mon, 28 Jul 2025 12:55:18 +0200 Subject: [PATCH] auth: fix remote IP determination for audit log This is probably isolated to dev or other small environments, but I had two issues with the remote IP determination, breaking the audit log display in my dev env after fairly standard usage. The gist is that the audit log is designed to contain clean IP addresses only. However, the algorithm starts out with `r.RemoteAddr`, which may contain a port (usually 127.0.0.1:xxxxx). The port removal is already performed at the beginning of the function, so simply re-use the result of this. Furthermore, the initial value (containing the port leading to breakage) landed in the audit log because I was using a private IP (it's my dev evn). We correctly trust private IPs, but that means if no public IP ever shows up in the X-Forwarded-For header, the last private IP was the one that actually made the request. I am not entirely sure why this showed up now. I already had a bunch of oder audit log entries that had the correct private-but-not-localhost addresses. But in the current state, e.g. simply updating my profile would cause the bad IP:port notation to be written to the audit log. --- auth/middleware.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/auth/middleware.go b/auth/middleware.go index e183059294c9047ef8f86ebf057bb03f2376b5ad..23ed0de4b45e5e0efb716f91f29f683093127e2a 100644 --- a/auth/middleware.go +++ b/auth/middleware.go @@ -299,7 +299,7 @@ func internalAuth(payload []byte, w http.ResponseWriter, r *http.Request, next h auth.InternalAuth = internalAuth auth.Grants, _ = DecodeGrants(r.Context(), "") - auth.IPAddress = r.RemoteAddr + auth.IPAddress = host var route []string for _, val := range r.Header.Values("X-Forwarded-For") { route = append(route, strings.Split(val, ",")...) @@ -309,10 +309,10 @@ func internalAuth(payload []byte, w http.ResponseWriter, r *http.Request, next h if ip == nil { continue } + auth.IPAddress = ip.String() if ip.IsPrivate() { continue } - auth.IPAddress = ip.String() break }