github-starred/vikunja
2
0
Fork 0
mirror of https://github.com/go-vikunja/vikunja.git synced 2026-05-12 08:53:26 -05:00
Code Issues 690 Packages Projects Releases 11 Wiki Activity

[PR #2421] [MERGED] fix: prevent rate limit bypass via spoofed IP headers #9970

New Issue
Closed
opened 2026-04-23 09:19:12 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-23 09:19:12 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/go-vikunja/vikunja/pull/2421
Author: @tink-bot
Created: 3/20/2026
Status: ✅ Merged
Merged: 3/20/2026
Merged by: @kolaente

Base: main ← Head: fix-rate-limit-bypass

📝 Commits (4)

  • 2486f55 feat: add service.ipextractionmethod and service.trustedproxies config options
  • 12cc676 fix: configure Echo IPExtractor to prevent rate limit bypass via spoofed headers
  • f6b56f7 docs: document IP extraction and trusted proxy config options
  • 57151ef style: fix alignment in config key declarations

📊 Changes

3 files changed (+54 additions, -0 deletions)

View changed files

📝 config-raw.json (+10 -0)
📝 pkg/config/config.go (+4 -0)
📝 pkg/routes/routes.go (+40 -0)

📄 Description

Summary

  • Configure Echo's IPExtractor to use ExtractIPDirect() by default (TCP remote address only, ignores forwarding headers)
  • Add service.ipextractionmethod config (direct/xff/realip) and service.trustedproxies for deployments behind reverse proxies
  • Document both new config options in config-raw.json

Security Advisory: GHSA-m547-hp4w-j6jx (Medium) — Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers

Test plan

  • Verify default (direct) ignores X-Forwarded-For and X-Real-IP headers
  • Verify xff mode with trusted proxy CIDRs extracts correct client IP
  • Verify realip mode with trusted proxy CIDRs extracts correct client IP
  • Verify rate limiting applies correctly with each extraction method

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/go-vikunja/vikunja/pull/2421 **Author:** [@tink-bot](https://github.com/tink-bot) **Created:** 3/20/2026 **Status:** ✅ Merged **Merged:** 3/20/2026 **Merged by:** [@kolaente](https://github.com/kolaente) **Base:** `main` ← **Head:** `fix-rate-limit-bypass` --- ### 📝 Commits (4) - [`2486f55`](https://github.com/go-vikunja/vikunja/commit/2486f55b2774eec970bd83da5d0bc0b468802508) feat: add service.ipextractionmethod and service.trustedproxies config options - [`12cc676`](https://github.com/go-vikunja/vikunja/commit/12cc6769f7c78fb0ada3db0a56277ee8599e6778) fix: configure Echo IPExtractor to prevent rate limit bypass via spoofed headers - [`f6b56f7`](https://github.com/go-vikunja/vikunja/commit/f6b56f74738c83319a619350b1bd6dc891039ad3) docs: document IP extraction and trusted proxy config options - [`57151ef`](https://github.com/go-vikunja/vikunja/commit/57151efe1a1dbeb73e24beae8cf6af8eaeef5439) style: fix alignment in config key declarations ### 📊 Changes **3 files changed** (+54 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `config-raw.json` (+10 -0) 📝 `pkg/config/config.go` (+4 -0) 📝 `pkg/routes/routes.go` (+40 -0) </details> ### 📄 Description ## Summary - Configure Echo's `IPExtractor` to use `ExtractIPDirect()` by default (TCP remote address only, ignores forwarding headers) - Add `service.ipextractionmethod` config (`direct`/`xff`/`realip`) and `service.trustedproxies` for deployments behind reverse proxies - Document both new config options in `config-raw.json` **Security Advisory:** GHSA-m547-hp4w-j6jx (Medium) — Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers ## Test plan - [ ] Verify default (`direct`) ignores `X-Forwarded-For` and `X-Real-IP` headers - [ ] Verify `xff` mode with trusted proxy CIDRs extracts correct client IP - [ ] Verify `realip` mode with trusted proxy CIDRs extracts correct client IP - [ ] Verify rate limiting applies correctly with each extraction method --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-23 09:19:12 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/api
area/attachments
area/auth
area/avatars
area/backup-restore
area/caldav
area/calendar-view
area/comments
area/config
area/database
area/desktop
area/docker
area/email
area/favorites
area/filters
area/frontend
area/gantt
area/i18n
area/import-export
area/internal-code
area/kanban
area/labels
area/list-view
area/mobile
area/notifications
area/permissions
area/projects
area/pwa
area/recurring-tasks
area/reminders
area/search
area/shortcuts
area/subtasks
area/sync
area/table-view
area/task-editor
area/task-metadata
area/task-relations
area/teams
area/theming
area/time-tracking
area/typesense
area/views
area/webhooks
bug
changes requested
concern/accessibility
concern/performance
concern/regression
concern/ux
confirmed
db/mysql
dependencies
enhancement
good first issue
help wanted
integration/inbound
integration/outbound
kind/bug
kind/feature
needs reproduction
pull-request
Mirrored from GitHub Pull Request
 question
security
support
upstream issue
waiting for reply
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vikunja#9970
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?