From 77bed5122fd7b47b1ce0ba72a4db042946a2d7f4 Mon Sep 17 00:00:00 2001 From: paul Date: Wed, 23 Jul 2025 15:03:24 +0200 Subject: [PATCH] fix: Forward real client IP through Docker proxy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Update setupProxy.js to forward X-Real-IP and X-Forwarded-For headers - Improve IP detection in backend middleware to prioritize X-Real-IP - Add debug logging for IP detection in development mode - Update .env.example with clearer IP configuration examples - Enable debug logging in docker-compose.dev.yml This fixes the issue where Docker network IPs (172.20.x.x) were being detected instead of the real client IP addresses. To fix IP restrictions, update your .env file: ALLOWED_IPS=10.30.30.0/24, 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude --- .env.example | 6 +++++- backend/src/middleware/ipFilter.middleware.js | 19 +++++++++++++++---- docker-compose.dev.yml | 1 + frontend/src/setupProxy.js | 14 ++++++++++++++ 4 files changed, 35 insertions(+), 5 deletions(-) diff --git a/.env.example b/.env.example index 2d5e028..5bb57b1 100644 --- a/.env.example +++ b/.env.example @@ -10,7 +10,11 @@ SESSION_TIMEOUT=1800 # IP Restrictions ENABLE_IP_RESTRICTION=true -ALLOWED_IPS=192.168.1.0/24,10.0.0.5,172.16.0.0/16 +# Add your IP or subnet here. Examples: +# - Single IP: 10.30.30.2 +# - Subnet: 10.30.30.0/24 +# - Multiple: 10.30.30.2,192.168.1.0/24,172.16.0.0/16 +ALLOWED_IPS=10.30.30.0/24,192.168.1.0/24,172.16.0.0/16,127.0.0.1 # MinIO Configuration DEFAULT_MINIO_ALIAS=kopiaminio diff --git a/backend/src/middleware/ipFilter.middleware.js b/backend/src/middleware/ipFilter.middleware.js index 3428a49..91fbca0 100644 --- a/backend/src/middleware/ipFilter.middleware.js +++ b/backend/src/middleware/ipFilter.middleware.js @@ -13,15 +13,26 @@ const ipFilterMiddleware = (req, res, next) => { return next(); } - // Get client IP - const clientIp = req.ip || + // Get client IP - priority order for headers when behind proxy + const clientIp = req.headers['x-real-ip'] || + req.headers['x-forwarded-for']?.split(',')[0].trim() || + req.ip || req.connection.remoteAddress || - req.socket.remoteAddress || - req.headers['x-forwarded-for']?.split(',')[0]; + req.socket.remoteAddress; // Normalize IPv6 localhost to IPv4 const normalizedIp = clientIp === '::1' ? '127.0.0.1' : clientIp; + // Debug logging in development + if (config.app.env === 'development') { + logger.debug(`IP Filter Debug - Headers: ${JSON.stringify({ + 'x-real-ip': req.headers['x-real-ip'], + 'x-forwarded-for': req.headers['x-forwarded-for'], + 'req.ip': req.ip, + 'detected': normalizedIp + })}`); + } + try { // Check if IP is in allowed list const isAllowed = ipRangeCheck(normalizedIp, config.security.allowedIps); diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml index 2a67c70..c24c52e 100644 --- a/docker-compose.dev.yml +++ b/docker-compose.dev.yml @@ -16,6 +16,7 @@ services: PORT: 7510 LOG_DIR: /app/logs TEMP_DIR: /app/temp + LOG_LEVEL: debug env_file: - .env ports: diff --git a/frontend/src/setupProxy.js b/frontend/src/setupProxy.js index 61b49f6..222cb41 100644 --- a/frontend/src/setupProxy.js +++ b/frontend/src/setupProxy.js @@ -7,6 +7,20 @@ module.exports = function(app) { target: process.env.BACKEND_URL || 'http://backend:7510', changeOrigin: true, logLevel: 'debug', + // Forward the real IP address + onProxyReq: (proxyReq, req, res) => { + // Get the real client IP + const clientIp = req.headers['x-forwarded-for'] || + req.connection.remoteAddress || + req.socket.remoteAddress || + req.connection.socket.remoteAddress; + + // Set the forwarded headers + proxyReq.setHeader('X-Forwarded-For', clientIp); + proxyReq.setHeader('X-Real-IP', clientIp); + proxyReq.setHeader('X-Forwarded-Proto', req.protocol); + proxyReq.setHeader('X-Forwarded-Host', req.headers.host); + }, onError: (err, req, res) => { console.error('Proxy Error:', err); res.status(500).json({ error: 'Proxy Error', message: err.message });