rule.ip does not respect http-proxy

Open

#3,107 opened on Dec 8, 2019 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 3/5
Estimated time: 1-2 days
Newbie friendliness: 35/100

Issue type: Bug
Clarity: Mostly clear
Activity status: Stale
Tech stack: erlang
Domain: api, backend, security

Research direction

Start by inspecting the ejabberd_http handling of X-Real-IP and the rule.ip checks used by api_permissions. Reproduce the setup behind an HTTP reverse proxy using the shown nginx headers, then verify that an internal-only permission is not exposed and that the client IP is interpreted correctly.

Written by the indexing model from the issue text.

Description

Kind:Enhancement

Environment

ejabberd version: 19.09.1
Erlang version: Erlang (SMP,ASYNC_THREADS,HIPE) (BEAM) emulator version 10.5
OS: Archlinux
Installed from: distro package

Bug description

If there is a http reverse proxy in front of ejabberd module: ejabberd_http it does not handle the HTTP Header-Field X-Real-IP.

(eg. nginx):

		proxy_set_header    Host            $host;
		proxy_set_header    X-Real-IP       $remote_addr;
		proxy_set_header    X-Forwarded-for $proxy_add_x_forwarded_for;

So api_permissions would be leaked public:

api_permissions:
  "onlyinternal":
    who:
       ip: ::1/128

Dominant language: Erlang
Stars: 6.7k
Forks: 1.6k
PR merge metrics: No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

[Bug] [Connector-V2] [Http] A streaming Http source never completes a checkpoint: poll_interval_millis is waited out holding the checkpoint lock Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

apache/seatunnel#12411 · Opened Sep 20, 2026
wafv2: TagResource/UntagResource don't enforce the 50-tag limit or key/value length limits Open

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

floci-io/floci#4035 · Opened Sep 20, 2026
[Duplicate Code] Repeated filtered model-alias assembly in proxy server Open

code-quality refactoring

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

github/gh-aw-firewall#8816 · Opened Sep 20, 2026
popularity.exclude_admin does not work for admin2 Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

getgrav/grav-plugin-api#45 · Opened Sep 20, 2026
quickjs: support `timeout=None` (no per-call deadline) in `CodeInterpreterMiddleware` Open

integration:quickjs org:external priority:backlog topic:code-interpreter topic:middleware type:feature

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

langchain-ai/deepagents#6450 · Opened Sep 20, 2026

More Backend & API Design issues