Tadrisino/MathApp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Trust X-Forwarded-For only from ArvanCloud edges

Browse Source 
nginx on the server also answers on its own IP. A direct request with a fresh
X-Forwarded-For each time got a new throttle identity every time and skipped
every per-IP limit (OTP request/login, admin login): reproduced on the server
2026-10-13, 65 of 65 health requests with rotating XFF got 200.

TrustedProxyMiddleware reads X-Real-IP (set by nginx from the TCP peer) and,
when the peer is not in TRUSTED_PROXY_NETWORKS (default: ArvanCloud's
published list), replaces XFF with the peer address. Logs a WARNING once an
hour per untrusted peer that sent a proxied XFF, so a new Arvan range shows up.

Also ignore the parallel test DB clones (.test-db_N.sqlite3).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Zareian
2026-10-13 18:45:27 +03:30
parent 78c3669119
commit e3bddb3757
4 changed files with 139 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@@ -19,7 +19,7 @@ staticfiles/
.deploy-backups/
# دیتابیسِ فایلیِ تست‌ها (config/settings.py → DATABASES.TEST)
.test-db.sqlite3*
.test-db*.sqlite3*
tools/fake_openai_requests.jsonl
.pg_password
.redis_password