Re: [Zope] Easiest way to turn X-Forwarded-For to Remote-IP?
Marcin Kasperski writes:
I use Zope via Apache proxy, what causes some trouble (all remote IPs for Zope are equal to 127.0.0.1).
As I finally installed mod_proxy_add_forward, I get original address in X-Forwarded-For header (REQUEST['HTTP_X_FORWARDED_FOR']).
The question is: can I do something easy to automatically perform if(remote_ip = 127.0.0.1 and X-Forwarded-For exists) then set remote_ip = whatever is in X-Forwarded-For logic? In particular, I would like changed IP to be used by Zope access control and Zope log. We have had similar problems.
Friendly people from NIP made a HowTo patch Apache to let the information through. If you do not want to patch Apache, you can use a SiteAccess (--> zope.org) AccessRule in your top (logical) folder to modify your REQUEST object as you like. Dieter
As I finally installed mod_proxy_add_forward, I get original address in X-Forwarded-For header (REQUEST['HTTP_X_FORWARDED_FOR']).
The question is: can I do something easy to automatically perform if(remote_ip = 127.0.0.1 and X-Forwarded-For exists) then set remote_ip = whatever is in X-Forwarded-For logic? In particular, I would like changed IP to be used by Zope access control and Zope log. We have had similar problems.
Friendly people from NIP made a HowTo patch Apache to let the information through.
If you do not want to patch Apache, you can use a SiteAccess (--> zope.org) AccessRule in your top (logical) folder to modify your REQUEST object as you like.
Does there exist some sample of such usage? Can such a change be performed before authorization? I use SiteRoot to translate addressess between external and internal (in subdirectories, not in main directory). Can those approaches be merged one with another? -- http://www.mk.w.pl / Marcin.Kasperski | Sztuczki i kruczki w C++: @softax.com.pl | http://www.mk.w.pl/porady/porady_cplusplus @bigfoot.com \
Marcin Kasperski writes:
As I finally installed mod_proxy_add_forward, I get original address in X-Forwarded-For header (REQUEST['HTTP_X_FORWARDED_FOR']).
The question is: can I do something easy to automatically perform if(remote_ip = 127.0.0.1 and X-Forwarded-For exists) then set remote_ip = whatever is in X-Forwarded-For logic? In particular, I would like changed IP to be used by Zope access control and Zope log. .... If you do not want to patch Apache, you can use a SiteAccess (--> zope.org) AccessRule in your top (logical) folder to modify your REQUEST object as you like.
Does there exist some sample of such usage? Can such a change be performed before authorization? The SiteAccess HowTo (documentation?) contains an example how to turn a path component into a REQUEST binding. Your case is much simpler, very straight forward.
I use SiteRoot to translate addressess between external and internal (in subdirectories, not in main directory). Can those approaches be merged one with another? They can. If you like, you can replace your SiteRoot (which in fact are simple forms of AccessRules) with full blown AccessRules and put the REMOTE_IP justification into them. However, I would do it in the root folder to have it at a single place.
Dieter
From: Marcin Kasperski <Marcin.Kasperski@softax.com.pl>
X-Forwarded-For header (REQUEST['HTTP_X_FORWARDED_FOR']). Does there exist some sample of such usage? Can such a change be performed before authorization?
You could do this with an Access Rule in your root folder, containing: <dtml-call expr="REQUEST.set('REMOTE_ADDR', REQUEST['HTTP_X_FORWARDED_FOR'])"> Cheers, Evan @ digicool & 4-am
participants (3)
-
Dieter Maurer -
Evan Simpson -
Marcin Kasperski