setup django-xff

Author: JakubMastalerz

poetry.lock

@@ -38,6 +38,7 @@ scout-apm = "^3.2.1"
 sentry-sdk = "^2.16.0"
 html5lib = "^1.1"
 beautifulsoup4 = "^4.12.3"
+django-xff = "^1.4.0"
 
 [tool.poetry.extras]
 gunicorn = ["gunicorn"]

pyproject.toml

@@ -86,6 +86,7 @@
     "django.middleware.security.SecurityMiddleware",
     "django_permissions_policy.PermissionsPolicyMiddleware",
     "whitenoise.middleware.WhiteNoiseMiddleware",
+    "xff.middleware.XForwardedForMiddleware",
     "django.contrib.sessions.middleware.SessionMiddleware",
     "django.middleware.common.CommonMiddleware",
     "django.middleware.csrf.CsrfViewMiddleware",
@@ -282,6 +283,7 @@
             "level": "WARNING",
             "propagate": False,
         },
+        "xff": {"handlers": ["console"], "level": "WARNING", "propagate": False},
     },
 }
 
@@ -477,6 +479,7 @@
             "BASIC_AUTH_WHITELISTED_HTTP_HOSTS"
         ].split(",")
 
+XFF_TRUSTED_PROXY_DEPTH = int(env.get("XFF_TRUSTED_PROXY_DEPTH", 1))
 
 AUTH_USER_MODEL = "users.User"
 

tbx/settings/base.py

@@ -3,6 +3,8 @@
 # Disable debug mode
 DEBUG = False
 
+# Error if there aren't enough proxies in between
+XFF_ALWAYS_PROXY = True
 
 try:
     from .local import *  # noqa

tbx/settings/production.py

@@ -24,3 +24,6 @@
 PASSWORD_HASHERS = ["django.contrib.auth.hashers.MD5PasswordHasher"]
 
 WAGTAILADMIN_BASE_URL = "http://localhost:8000"
+
+# Ignore proxy count in tests
+XFF_ALWAYS_PROXY = False