Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fixes issue #6283 and #6300 #6337

Open
wants to merge 9 commits into
base: main
Choose a base branch
from
Open

fixes issue #6283 and #6300 #6337

wants to merge 9 commits into from

Conversation

viveak910
Copy link

@viveak910 viveak910 commented Sep 26, 2024

Fixed issue #6283 with proxy requests not setting X-Real-IP, X-Forwarded-For, and X-Forwarded-Host headers correctly.

Copy link

netlify bot commented Sep 26, 2024

Deploy Preview for plone-components canceled.

Name Link
🔨 Latest commit ab09daf
🔍 Latest deploy log https://app.netlify.com/sites/plone-components/deploys/67171d9dda21390008dc6f1c

@viveak910
Copy link
Author

Could someone take a look when they get a chance? Let me know if anything needs to be changed or if it’s good to go! 🙌

packages/volto/CHANGELOG.md Outdated Show resolved Hide resolved
@viveak910
Copy link
Author

yeah got it @stevepiercy

Copy link
Collaborator

@stevepiercy stevepiercy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

News is OK. This needs technical review from @plone/volto-team.

packages/volto/news/6283.bugfix Outdated Show resolved Hide resolved
@stevepiercy
Copy link
Collaborator

@sneridagh
Copy link
Member

@djay @JeffersonBledsoe could you review this, please?

@viveak910 viveak910 closed this Oct 5, 2024
@viveak910 viveak910 reopened this Oct 5, 2024
@viveak910 viveak910 closed this Oct 5, 2024
@viveak910 viveak910 reopened this Oct 5, 2024
@viveak910
Copy link
Author

Hi, everyone. I’m new to this process, and I wanted to check if my PR has been merged or just approved. Should I close the PR myself now that the changes have been approved, or will someone else handle it? Thanks!

@stevepiercy
Copy link
Collaborator

@viveak910 a member of the Volto Team will merge the PR. Please do not close and reopen the PR, as each action sends a notification to all subscribers, needlessly spamming them and making them grumpy.

// Fixes https://github.com/chimurai/http-proxy-middleware/issues/320
if (!req.body || !Object.keys(req.body).length) {
return;
}
// Set headers for the proxy request
proxyReq.setHeader('X-Real-IP', req.ip);
proxyReq.setHeader('X-Forwarded-For', req.ip);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If the incoming request already has X-Forwarded-For from another proxy, we should keep that value and add req.ip to the end of the list: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For

"typescript": "^5.4.5",
"vitest": "^1.5.0"
"typescript": "^5.6.2",
"vitest": "^2.1.2"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why/how did you update these dependencies? They should not be included in the PR unless they are required for the change to the proxy. (Same thing for the changes in pnpm-lock.yaml)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants