983249 - Use X-Forwarded-For HTTP Header for client location detection

Status: RESOLVED FIXED

(Marketplace Graveyard :: General, defect, P1)

Description

[Jason Thomas [:jason]]

REMOTE_ADDR does not always have the correct client IP information, especially with IPV6 requests. We pass X-Forwarded-For HTTP Header with client IP address information for both IPV4 and IPV6 addresses and we should use that instead. 

https://github.com/mozilla/zamboni/blob/master/mkt/regions/middleware.py#L22

Comment 1

[Mathieu Pillard [:mat]]

We are already doing that (we populate REMOTE_ADDR with HTTP_X_FORWARDED_FOR) with  'commonware.middleware.SetRemoteAddrFromForwardedFor' in our MIDDLEWARE_CLASSES settings. It was updated a few months ago to support IPV6.

Comment 2

[Mathieu Pillard [:mat]]

See https://github.com/jsocol/commonware/blob/master/commonware/request/middleware.py#L18

Comment 3

[Jason Thomas [:jason]]

We may just need to update KNOWN_PROXIES to include our LB address as it is not currently listed.

https://github.com/mozilla/zamboni/blob/master/sites/prod/settings_base.py

Comment 4

[Jason Thomas [:jason]]

Updated https://github.com/mozilla/zamboni/commit/cc9fbd1289322383b22f08aad0e5ff5166b1f34d.