* if the server is incorrectly setup and accessible not just via cloudflare but directly (no ip allowlist and/or no origin certificate), user can set the xff header to whatever they want (but the current version of cobalt also has this issue lol)
(note: by "default config" i mean the bare minimum to proxy cobalt through that particular webserver)
also ratelimits IPv6 addresses by prefix instead of individual addresses
i set it at /56, which should not be too strict (yet allows a /48 holder to make 256 as many requests instead of 2^80 as many requests which is "better" i guess), change if needed
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/imputnet/cobalt/pull/163
**Author:** [@dumbmoron](https://github.com/dumbmoron)
**Created:** 7/28/2023
**Status:** ✅ Merged
**Merged:** 1/31/2024
**Merged by:** [@wukko](https://github.com/wukko)
**Base:** `current` ← **Head:** `xff`
---
### 📝 Commits (2)
- [`a375000`](https://github.com/imputnet/cobalt/commit/a375000ae9f1e9c5648a09438f47f01dd53b5915) api: use req.ip instead of cloudflare headers, ratelimit ipv6 by prefix
- [`01240b6`](https://github.com/imputnet/cobalt/commit/01240b6ca3e8bacd77be286222ab07657edd2394) utils: getIP formatting
### 📊 Changes
**3 files changed** (+17 additions, -3 deletions)
<details>
<summary>View changed files</summary>
📝 `package.json` (+1 -0)
📝 `src/core/api.js` (+4 -2)
📝 `src/modules/sub/utils.js` (+12 -1)
</details>
### 📄 Description
allows for more versatile configurations that do not necessarily have to use cloudflare
works with:
+ accessing port 9000 directly -> req.ip is actual ip, xff is ignored
+ no cloudflare, reverse proxy (caddy: default config, nginx: needs `add_header`)
+ cloudflare (nginx: default config*, caddy: needs `trusted_proxies`)
\* if the server is incorrectly setup and accessible not just via cloudflare but directly (no ip allowlist and/or no origin certificate), user can set the xff header to whatever they want (but the current version of cobalt also has this issue lol)
(note: by "default config" i mean the bare minimum to proxy cobalt through that particular webserver)
also ratelimits IPv6 addresses by prefix instead of individual addresses
i set it at /56, which should not be too strict (yet allows a /48 holder to make 256 as many requests instead of 2^80 as many requests which is "better" i guess), change if needed
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/imputnet/cobalt/pull/163
Author: @dumbmoron
Created: 7/28/2023
Status: ✅ Merged
Merged: 1/31/2024
Merged by: @wukko
Base:
current← Head:xff📝 Commits (2)
a375000api: use req.ip instead of cloudflare headers, ratelimit ipv6 by prefix01240b6utils: getIP formatting📊 Changes
3 files changed (+17 additions, -3 deletions)
View changed files
📝
package.json(+1 -0)📝
src/core/api.js(+4 -2)📝
src/modules/sub/utils.js(+12 -1)📄 Description
allows for more versatile configurations that do not necessarily have to use cloudflare
works with:
add_header)trusted_proxies)* if the server is incorrectly setup and accessible not just via cloudflare but directly (no ip allowlist and/or no origin certificate), user can set the xff header to whatever they want (but the current version of cobalt also has this issue lol)
(note: by "default config" i mean the bare minimum to proxy cobalt through that particular webserver)
also ratelimits IPv6 addresses by prefix instead of individual addresses
i set it at /56, which should not be too strict (yet allows a /48 holder to make 256 as many requests instead of 2^80 as many requests which is "better" i guess), change if needed
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.