litespeedtech / litespeedtech/openlitespeed
Default value for useipinproxyheader AKA Use Client IP in Header
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.5k
- Forks
- 233
- Avg merge
- 2d 19h
- Merged PRs (30d)
- 5
Description
Hi,
## Info
We discovered our hosting company has it set to YES and they're claiming that's the default value. I see this as a huge security risk, when anyone can easily spoof the IP by simply changing the x-forwaded-for header. Even LightSpeed docs warn agains it in https://www.litespeedtech.com/support/wiki/doku.php/litespeed_wiki:config:show-real-ip-behind-cloudflare
In our case, we expect the PHP REMOTE_ADDR to be the "last client", in our case that's the Proxy Server, but having useipinproxyheader set to YES means anyone can pretend to be from our network and gain access to IP blocked resources.
## Questions :
What's the default value for useipinproxyheader ?
[After searching the repo](https://github.com/search?q=repo%3Alitespeedtech%2Fopenlitespeed+useipinproxyheader+&type=code), I see it's NULL, but what does that mean for a default installation ?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the repository search for `useipinproxyheader` and compare its NULL value with the LightSpeed documentation linked in the issue. Done means documenting the effective default for a fresh installation and explaining whether the setting can allow spoofed client IP addresses.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- backend, security
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100