Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] X-Forwarded-For containing multiple IPs does not respect inet data type #178

Open
robertalexa opened this issue May 26, 2023 · 1 comment

Comments

@robertalexa
Copy link

Describe the bug
When using DJANGO_REST_PASSWORDRESET_IP_ADDRESS_HEADER behind a proxy server, the actual value may contain multiple IPs, separated by a comma, with the first value being the client IP and the last being the last proxy server hit.

In such a scenario, inserting into the DB fails with an error because the data tried to be inserted is not of inet data type. Looking at the code, there is not split attempting to just use the client IP (first value). Alternatively, the model should be changed to not be inet

How to reproduce
Test behind a proxy server

Internal Server Error: /auth/password-reset/
REDACTED  | Traceback (most recent call last):
REDACTED  |   File "/usr/local/lib/python3.10/site-packages/django/db/backends/utils.py", line 89, in _execute
REDACTED  |     return self.cursor.execute(sql, params)
REDACTED  | psycopg2.errors.InvalidTextRepresentation: invalid input syntax for type inet: "82.xx.xx.xx, 192.168.32.1"
@robertalexa
Copy link
Author

By the way, this is also wrong in the docs:
image

The variable should be DJANGO_REST_PASSWORDRESET_HTTP_USER_AGENT_HEADER

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant