Reject client-controlled forwarding entries when deriving client IP #62

New Issue

2026-11-05T12:09:28Z

spencerm commented

2026-11-05 12:09:28 +00:00

Priority: medium. Deployment-dependent security impact.

server/packetstation/proxy.py:82 selects the first X-Forwarded-For entry when the immediate peer is trusted. If the proxy appends the actual client address, a supplied first entry is trusted as the client's identity. Repository proxy guidance uses append semantics for its custom location: deploy/npm-proxy-host.md:55.

Local reproduction: pass a trusted peer and X-Forwarded-For: 198.51.100.99, 192.0.2.25 to forwarded(). It returns 198.51.100.99, not the proxy-appended client 192.0.2.25. This was reproduced locally. The running NPM sign-in route configuration has not been inspected.

Impact under an appending proxy: spoofed audit IPs and evasion of per-IP sign-in limits/alerts. Account-based controls remain separate.

Acceptance criteria:

Verify the deployed proxy behavior for sign-in and API routes.
Either overwrite forwarding headers at the trusted ingress or resolve the trusted chain from the right, accepting only known proxy hops.
Test attacker-supplied prefixes, malformed values, multiple hops and untrusted direct peers.
Update deployment guidance and the existing first-entry test to match the enforced trust model.

Source: GLM; parser behavior reproduced by parent.

Reviewed revision: 18333600b55b70971877c1a0c72d1d61b6ce9c69. Raised from the November 2026 independent project reviews and parent verification. No production system was tested.

Priority: medium. Deployment-dependent security impact. [server/packetstation/proxy.py:82](https://gt.pescoinc.biz/spencerm/PacketStation/src/commit/18333600b55b70971877c1a0c72d1d61b6ce9c69/server/packetstation/proxy.py#L82) selects the first X-Forwarded-For entry when the immediate peer is trusted. If the proxy appends the actual client address, a supplied first entry is trusted as the client's identity. Repository proxy guidance uses append semantics for its custom location: [deploy/npm-proxy-host.md:55](https://gt.pescoinc.biz/spencerm/PacketStation/src/commit/18333600b55b70971877c1a0c72d1d61b6ce9c69/deploy/npm-proxy-host.md#L55). Local reproduction: pass a trusted peer and X-Forwarded-For: 198.51.100.99, 192.0.2.25 to forwarded(). It returns 198.51.100.99, not the proxy-appended client 192.0.2.25. This was reproduced locally. The running NPM sign-in route configuration has not been inspected. Impact under an appending proxy: spoofed audit IPs and evasion of per-IP sign-in limits/alerts. Account-based controls remain separate. Acceptance criteria: - Verify the deployed proxy behavior for sign-in and API routes. - Either overwrite forwarding headers at the trusted ingress or resolve the trusted chain from the right, accepting only known proxy hops. - Test attacker-supplied prefixes, malformed values, multiple hops and untrusted direct peers. - Update deployment guidance and the existing first-entry test to match the enforced trust model. Source: GLM; parser behavior reproduced by parent. Reviewed revision: `18333600b55b70971877c1a0c72d1d61b6ce9c69`. Raised from the November 2026 independent project reviews and parent verification. No production system was tested.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: spencerm/PacketStation#62