Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix for ticket #904 - Addition of get_claimed_ip() to HTTPRequest #1051

Closed
wants to merge 1 commit into from

Conversation

moijes12
Copy link
Contributor

As per ticket description of ticket #904, a method to return the first
public IP address from X-Forwarded-For should be implemented. This
update contains the below changes:

  1. In tornado/httpserver.py
    HTTPRequest.get_claimed_ip() is implemented which simply returns
    remote_ip
  2. In tornado/test/httpserver_test.py
    The test for verifying ip_headers already existed in XHeaders. I simply
    modified the internal class Handler to retrieve the output of
    get_claimed_ip from the request messge and write it to the dictionary.
    The same tests that were written for verifying ip_headers have been
    re-used except that they now check that remote ip equals claimed_ip

…equest

As per ticket description of ticket tornadoweb#904, a method to return the first
public IP address from X-Forwarded-For should be implemented. This
update contains the below changes:

1. In tornado/httpserver.py
HTTPRequest.get_claimed_ip() is implemented which simply returns
remote_ip

2. In tornado/test/httpserver_test.py
The test for verifying ip_headers already existed in XHeaders. I simply
modified the internal class Handler to retrieve the output of
get_claimed_ip from the request messge and write it to the dictionary.
The same tests that were written for verifying ip_headers have been
re-used except that they now check that remote ip equals claimed_ip
@bdarnell
Copy link
Member

get_claimed_ip should not simply return request.remote_ip. When a multi-valued X-Forwarded-For header is present, remote_ip should be the last value in the header, and get_claimed_ip should be the first non-private address (i.e. excluding the rfc 1918 blocks and 127/8), with analogous logic for the other xheaders (but simpler since X-Forwarded-For is the only one that takes multiple values). We may even want to interpret X-Forwarded-For for purposes of get_claimed_ip even when xheaders is disabled.

@bdarnell
Copy link
Member

Closing due to inactivity.

@bdarnell bdarnell closed this Jun 10, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants