mirrors/etherpad-lite
1
0
Fork 0
mirror of https://github.com/ether/etherpad-lite.git synced 2025-04-21 16:06:16 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 26

security: Support proxy with rate limiting and include CI test coverage for nginx rev proxy (#4373)

Browse source 
Previously Etherpad would not pass the correct client IP address through and this caused the rate limiter to limit users behind reverse proxies.  This change allows Etherpad to use a client IP passed from a reverse proxy.

Note to devs: This header can be spoofed and spoofing the header could be used in an attack.  To mitigate additional *steps should be taken by Etherpad site admins IE doing rate limiting at proxy.*  This only really applies to large scale deployments but it's worth noting.
This commit is contained in:
webzwo0i 2020-10-01 11:39:01 +02:00 • committed by GitHub
parent dbef630f44
commit ceb09ce99a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
9 changed files with 120 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/node/handler/PadMessageHandler.js
View file

@ -181,10 +181,11 @@ exports.handleMessage = async function(client, message)
var env = process.env.NODE_ENV || 'development';
if (env === 'production') {
const clientIPAddress = remoteAddress[client.id];
try {
await rateLimiter.consume(client.handshake.address); // consume 1 point per event from IP
await rateLimiter.consume(clientIPAddress); // consume 1 point per event from IP
}catch(e){
console.warn("Rate limited: ", client.handshake.address, " to reduce the amount of rate limiting that happens edit the rateLimit values in settings.json");
console.warn("Rate limited: ", clientIPAddress, " to reduce the amount of rate limiting that happens edit the rateLimit values in settings.json");
stats.meter('rateLimited').mark();
client.json.send({disconnect:"rateLimited"});
return;