pjandro/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-10-30 01:34:59 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(web): read the client address from the proxy end of forwarded headers

Browse Source 
getRemoteIp took a trusted proxy's X-Real-IP first, otherwise the leftmost
X-Forwarded-For entry. A proxy that forwards a client-sent X-Real-IP
unchanged (Caddy, HAProxy) or appends to X-Forwarded-For leaves both values
to the client. X-Forwarded-For is now read from the right, skipping trusted
proxies. X-Real-IP is believed only when it agrees with that hop or stands
alone, and a disagreement falls back to the proxy's own address.

The documented Caddyfile and the docs reverse-proxy generator now overwrite
X-Real-IP with the address Caddy saw.
This commit is contained in:
MHSanaei
2026-10-24 01:39:23 +02:00
parent 1df8ab29f8
commit d50c419e28
8 changed files with 87 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/lib/xray/reverse-proxy.ts
+5 -7
View File
@@ -49,14 +49,12 @@ function buildNginx(o: ReverseProxyOptions): string {
function buildCaddy(o: ReverseProxyOptions): string {
const path = normalizePath(o.panelPath);
if (path === '/') {
return `${o.domain} {
reverse_proxy 127.0.0.1:${o.panelPort}
}`;
}
const matcher = `${path.replace(/\/$/, '')}/*`;
const matcher = path === '/' ? '' : `${path.replace(/\/$/, '')}/* `;
// Caddy forwards a client-sent X-Real-IP as is; the panel's login limiter reads it.
return `${o.domain} {
reverse_proxy ${matcher} 127.0.0.1:${o.panelPort}
reverse_proxy ${matcher}127.0.0.1:${o.panelPort} {
header_up X-Real-IP {remote_host}
}
}`;
}