litespeedtech / litespeedtech/openlitespeed

Default value for useipinproxyheader AKA Use Client IP in Header

Open
#353 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C++
Stars
1.5k
Forks
233
Avg merge
2d 19h
Merged PRs (30d)
5

Description

Hi,

## Info
We discovered our hosting company has it set to YES and they're claiming that's the default value. I see this as a huge security risk, when anyone can easily spoof the IP by simply changing the x-forwaded-for header. Even LightSpeed docs warn agains it in https://www.litespeedtech.com/support/wiki/doku.php/litespeed_wiki:config:show-real-ip-behind-cloudflare

In our case, we expect the PHP REMOTE_ADDR to be the "last client", in our case that's the Proxy Server, but having useipinproxyheader set to YES means anyone can pretend to be from our network and gain access to IP blocked resources.

## Questions :
What's the default value for useipinproxyheader ?
[After searching the repo](https://github.com/search?q=repo%3Alitespeedtech%2Fopenlitespeed+useipinproxyheader+&type=code), I see it's NULL, but what does that mean for a default installation ?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the repository search for `useipinproxyheader` and compare its NULL value with the LightSpeed documentation linked in the issue. Done means documenting the effective default for a fresh installation and explaining whether the setting can allow spoofed client IP addresses.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
backend, security
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.