x-forwarded-for doesn't work
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 45/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- python
- Domain
- networking
Research direction
Start by tracing _apply_xheaders and how trusted_downstream reaches it, then inspect netutil.is_valid_ip for bracketed IPv6 addresses. Reproduce the reported X-Forwarded-For behavior and add focused coverage for the affected cases; done means forwarded client addresses are handled correctly without losing the trusted downstream configuration.
Written by the indexing model from the issue text.
Description
My logs show either the forwarder or 127.0.0.1.
This is version 6.5.2, with jupyterhub.
I put debug statements in _apply_xheaders
- trusted_downstream isn't being passed through to that point. i.e. it's empty or undefined.
- netutil.is_valid_ip rejects [2620:0:d60:ac1a::10]
There's always ambiguity in the specs whether IP addresses should have [] around them. Fortigate uses it: AWs documtation says they do https://docs.aws.amazon.com/elasticloadbalancing/latest/application/x-forwarded-headers.html. Wikipedia says some implementations use [] and some don't: https://en.wikipedia.org/wiki/X-Forwarded-For
Here's what I got from a Fortigate acting as a load balancer:
X-Forwarded-For: [2620:0:d60:ac1a::10]
- Dominant language
- Python
- Stars
- 22.2k
- Forks
- 5.6k
- Avg merge
- 3h 42m
- Merged PRs (30d)
- 16
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from tornadoweb/tornado
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
tornadoweb/tornado#3701 · 1 comment ·
-
httpserver
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
tornadoweb/tornado#1050 · 2 comments ·
-
Difficulty 3/5 1-2 days Newbie friendliness 55/100
tornadoweb/tornado#3728 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 64/100
tornadoweb/tornado#3651 · 2 comments ·
-
Difficulty 4/5 3-5 days Newbie friendliness 50/100
tornadoweb/tornado#3616 · 2 comments ·
All issues in tornadoweb/tornado
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
bancolombia/sentinel#23 ·
-
test md OpenCI
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
integration:quickjs org:external priority:backlog topic:code-interpreter topic:middleware type:feature
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
langchain-ai/deepagents#6450 ·
-
bug client
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100