-
-
Notifications
You must be signed in to change notification settings - Fork 1.6k
Description
See odoo/documentation#6744 for context.
Nevertheless there are still circumstances where the x-forwarded-for does not and cannot have the client IP as last item. For instance I'm having this situation right now with a customer on Azure Container Apps.
So I propose a server wide module named base_trusted_proxies which patches odoo.http.ProxyFix to set x_for to a number obtained from an ODOO_TRUSTED_PROXIES environment variable. The default value would be 1 as it is how Odoo works out of the box.
In the roadmap for this module, we'd add a mention that a special value is reserved to mean that all proxies are trusted and the 1st value in x-forwarded-for is always considered to be the client ip. This must come with the appropriate security caveat.