Contrib.social

Incorrect user's IP address when uses more than one proxy server

Open on Drupal.org →
Created on 28 November 2023, over 1 year ago

Problem/Motivation

I have found that when a site uses more than one proxy server or Varnish or Cloudflare, module EU Cookie Compliance (GDPR Compliance) adds to DB Incorrect user's IP address after click to button "Accept all" or "Reject all".

Steps to reproduce

- check on project with Cloudflare, few proxy servers or locally can test with Varnish container
- install module and configure EU Cookie Compliance (GDPR Compliance) module
- open site by anonymous and press button "Allow all" on popup cookie window
- check IP address in table "eu_cookie_compliance_basic_consent" of DB and see IP of Cloudflare, proxy server or Varnish container, not a user's IP address.

Proposed resolution

It is related to realization of method Plugin/ConsentStorage/BasicConsentStorage.php:registerConsent that get header "REMOTE_ADDR" when trusted proxies were not set via "setTrustedProxies()".

$ip_address = \Drupal::request()->getClientIp();

https://github.com/symfony/http-foundation/blob/6.3/Request.php#L788

I propose to get the first IP address from header "X-Forwarded-For", because if a request is chained through more than one proxy server, then each proxy adds the IP of the preceding one to the existing X-Forwarded-For header so that the entire chain is preserved. The first IP address in header "X-Forwarded-For" equals the user's IP address.

🐛 Bug report
Status

Active

Version

1.24

Component

Code

Created by

🇺🇦Ukraine ankondrat4 Lutsk

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024