remote_ip not overwritten from X-Forwarded-For

[esdrasedu]

In the docs say:

But it not doing that. I don know if if is change on Cowboy or if is implementation incomplete on Plug.Conn

Versions:
OS: Darwin 15.0.0
Elixir: 1.1.1
Erlang/OTP: 18
Plug: 1.0.3

[josevalim]

It is meant to be overridden by plugs. We don't provide the feature that overrides it, it is up to you.

[micahwedemeyer]

In case anyone else is still looking for this, I found this project today: https://github.com/awetzel/plug_forwarded_peer

It looks like it's a plug to do exactly what is desired here.

[esdrasedu]

Thanks @micahwedemeyer , I make plug too:

  import Plug.Conn

  def init(opts), do: opts

  def call(conn, _opts) do
    ip = case get_req_header(conn, "x-forwarded-for") do
       [proxy_ip] -> proxy_ip |> first_ip |> valid_ip
       _ -> conn.remote_ip |> Tuple.to_list |> Enum.join(".") |> valid_ip
    end
    conn |> assign(:ip, ip)
  end

  defp first_ip(ips) do
    case String.split(ips, ",") do
      [ip] -> ip
      [ip, _proxy_ip] -> ip
    end
  end

  defp valid_ip(ip) do
    re = ~r/^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$/
    case Regex.match?(re, ip) do
      true -> ip
      false -> nil
    end
  end

But need fixes, I will look is other plug! Thanks again

[MSch]

If anyone needs it, here's what we do:

defmodule RemoteIPPlug do
  @behaviour Plug
  import Plug.Conn

  def init([]), do: []

  def call(conn, []) do
    case get_req_header(conn, "x-real-ip") do
      [] -> conn
      [real_ip] ->
        case :inet_parse.address(to_char_list(real_ip)) do
          {:ok, real_ip} -> %{conn | remote_ip: real_ip}
          _ -> conn
        end
    end
  end
end

[ajvondrak]

I recently came across this issue and went down the rabbit hole of figuring out how to get this working, resulting in Yet Another Package™. For visibility / in case it helps anyone: https://github.com/ajvondrak/remote_ip

[josevalim]

Btw, the reason we don't override remote_ip by default is because doing so without actually having a proxy in front of you is a security risk (it can lead to ip-spoofing for example).

[ajvondrak]

Yup. Noted that in my README.md. :)

[JustMikey]

Just wanted to point out that at least x-forwarded-for may have 2 or 3 values in the list, so be careful because it may break your pattern matching if it's not handling this case.