tm-kn / django-basic-auth-ip-whitelist Goto Github PK

• Stop assuming 401 does not get cached.

https://github.com/tm-kn/django-basic-auth-ip-whitelist/blob/318006b15b598c035cf52031c8fa63dbf241440f/baipw/utils.py#L23

This is the situation:

• this default get_client_ip is called by self._get_client_ip()
• which takes whatever this returns and passes it to ipaddress.ip_address()
• which doesn't accept None as an input
• so if this code path is hit, ipaddress.ip_address() will exception out
• but baipw doesn't handle this exception, so it just escalates up, and the whole app just ends up 500-ing.

So this code path is problematic, if there isn't a saner return, then at least maybe warn others that if this code branch is hit, the app will blow up.

• We don't want get_client_ip implementation in the package at all.
• If the function is not configured, we don't want any IP checks to be done.
• Add some recipes to the documentation.

This may be useful for having website behind CDN.

👋 Trying to run this on a Wagtail project in Azure App Service (containerised), I’m getting the following exception:

ValueError: '147.243.178.14:13250' does not appear to be an IPv4 or IPv6 address

Full stack trace:

[…]
  File "/usr/local/lib/python3.8/site-packages/baipw/middleware.py", line 18, in __call__
    response = self.process_request(request)
  File "/usr/local/lib/python3.8/site-packages/baipw/middleware.py", line 35, in process_request
    if self._is_ip_whitelisted(request):
  File "/usr/local/lib/python3.8/site-packages/baipw/middleware.py", line 128, in _is_ip_whitelisted
    ip_address = ipaddress.ip_address(self._get_client_ip(request))
  File "/usr/local/lib/python3.8/ipaddress.py", line 53, in ip_address
    raise ValueError('%r does not appear to be an IPv4 or IPv6 address' %
ValueError: '147.243.178.14:13250' does not appear to be an IPv4 or IPv6 address

This looks like it would be due to the port. It’s not too clear to me which HTTP header might contain it though. Here is my hacky workaround to remove the port:

Edit: removed as my workaround was only working locally when manually setting a few specific headers.

One-liner to try this out:

curl -I --header 'X-Forwarded-For: 147.243.178.14:13250' http://localhost:8000/

We ideally no longer want to deal with specific checks in the code (no explicit reference to hosts, paths or IP addresses). We could just call them hooks that return a boolean value.

After IP is allowed via this middleware, there's no indication to that it has been applied. This would be very useful in order to configure the front-end cache bypass.

• IP allowed indication in the response (possibly a custom header)
• Guidelines on using with FE cache.
• Implemented in torchbox/cloudflare-recipes

• Make it more generic.
  • Third party libraries?
  • Pluggable backends?
  • Configurable rules for different providers?
• Make user's IP address won't crash the server.

Related: #7, #4