Allow using 'x-forwarded-for' as source ip addr

[XiaoliChan]

Now it can use 'x-forwarded-for' as the real source IP address, for some situations like the http server behind the Cloudflare

Enable it with forwarded_as_sources_ip

Test with Cloudflare CDN service:

• Without forwarded_as_sources_ip, the module didn't detect my real source IP.
  

• With forwarded_as_sources_ip, the module now can detect my real source IP.
  
  
  

[francislavoie]

This is insecure and should not be merged as-is. The X-Forwarded-For header is spoofable. (Someone could set the header to an IP from an allowed country then send that directly to Caddy)

Caddy provides a secure way of reading the data from that header via https://caddyserver.com/docs/caddyfile/options#trusted-proxies. The plugin could read from the client_ip stored in the request context, and match against that.

[ale-rinaldi]

This is insecure and should not be merged as-is. The X-Forwarded-For header is spoofable. (Someone could set the header to an IP from an allowed country then send that directly to Caddy)

Caddy provides a secure way of reading the data from that header via https://caddyserver.com/docs/caddyfile/options#trusted-proxies. The plugin could read from the client_ip stored in the request context, and match against that.

Yeah, that's correct. It's what I wanted to answer, then my wife had a baby and I totally forgot about this :P
I'm gonna make the change to rely on Caddy's first-class support for this. PRs welcome meanwhile :)

[XiaoliChan]

Yes, caddy now is support client_ip, before that, I used it long time ago.

[ale-rinaldi]

Yes, caddy now is support client_ip, before that, I used it long time ago.

Yeah, I see and I'm happy your fork solved the situation for you.
Actually, first-class support for client IP was introduced with caddyserver/caddy#5104 that dates a little before your pull request. That's why I never merged it: I planned to rely on Caddy official support, but I never managed to implement it and I forgot to update about this on this PR. My fault, sorry.

If you or @francislavoie or anyone else is willing to do a PR for this, that would be really appreciated.

[ZeroAnarchy]

@ale-rinaldi

If you or @francislavoie or anyone else is willing to do a PR for this, that would be really appreciated.

Ready! PR #26 and #27

[ale-rinaldi]

Good job @ZeroAnarchy ! They're merged