Option to configure the number of proxies about django-ipware HOT 4 CLOSED

Version 2.0 has Proxy Count support added. Version 1.x is deprecated, however, I don't have any plans in removing the api. Cheers

from django-ipware.

@aleksihakli as per my explanation here, nothing stops a hacker to set up additional proxies to match the proxy count.

Please provide a use case that we need a proxy count on top of the already supported trusted proxy list in order for me to include such a feature in the next release. thx.

from django-ipware.

Unofficial -- Look at the source code for get_client_ip()

from django-ipware.

@un33k yeah, I thought of it more as a convenience feature, I'm aware that attackers can do DNS rebinding and proxy injection on the server end or just forge headers by hand in the client end.

The case is indeed that I'm getting a ton of unwanted traffic on AWS with no proxies set at all in the request headers and want to discard that, and am using proxy count in a middleware to cut the unwanted noise, and think that this is useful for tracking bots and improperly configured clients.

In Axes it's nice to also get notified of someone banging the authentication backend with improper requests :)

I think the 2.0 beta release looks good for the purpose and the trusted proxies approach is good for semi-static proxy IPs. It can be hard to figure out proxy IPs in elastic environments where load balancers have dynamically changing IP ranges, so the proxy count is more usable there.

Just wanted to raise the question up for discussion.

from django-ipware.