Crawler ACLs issue - X-forwarded-for
Nuranto opened this issue · 2 comments
Nuranto commented
Hello,
In VCL templates, client.ip should be replaced by std.ip(regsub(req.http.X-Forwarded-For, "^(^[^,]+),?.*$", "\1"), client.ip) when checking ACLs.
Else it could use 127.0.0.1 as IP instead of real-user IP and cause troubles in softwares.
Of course, this issue occurs only if you have a proxy on front of varnish (which is almost always the case, at least for dealing with https).
Example :
Before :
if (client.ip ~ crawler_acl ||
After :
if (std.ip(regsub(req.http.X-Forwarded-For, "^(^[^,]+),?.*$", "\1"), client.ip) ~ crawler_acl ||
bmalynovytch commented
To complete @Nuranto's point: when Varnish is behind a local reverse proxy, ACLs are checked against ::1 which is useless and leads to strange behaviors.