Skip to content

feat: django-axes prefers forwarded ip address #481

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
charn merged 2 commits into from
Mar 24, 2026
Merged

feat: django-axes prefers forwarded ip address #481

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f6af725
chore: bump commitlint
charn Mar 24, 2026
c62e9b0
feat: django-axes prefers forwarded ip address
charn Mar 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .pre-commit-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ repos:
# Run the formatter.
- id: ruff-format
- repo: https://github.com/alessandrojcm/commitlint-pre-commit-hook
rev: v9.22.0
rev: v9.24.0
hooks:
- id: commitlint
stages: [ commit-msg, manual ]
Expand Down
2 changes: 2 additions & 0 deletions palvelutarjotin/settings.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -447,6 +447,8 @@ def sentry_traces_sampler(sampling_context: SamplingContext) -> float:

AXES_FAILURE_LIMIT = 5
AXES_COOLOFF_TIME = 1 # hour after locked out, user will be able to attempt login
AXES_IPWARE_META_PRECEDENCE_ORDER = ["HTTP_X_FORWARDED_FOR", "REMOTE_ADDR"]
Comment thread
sentry[bot] marked this conversation as resolved.
AXES_IPWARE_PROXY_COUNT = 1

@sentry sentry Bot Mar 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The AXES_IPWARE_PROXY_COUNT is hardcoded to 1, creating an IP spoofing vulnerability in local development and causing incorrect IP detection in multi-proxy environments.
Severity: HIGH

Suggested Fix

Make the AXES_IPWARE_PROXY_COUNT setting configurable via an environment variable, similar to other infrastructure-dependent settings like USE_X_FORWARDED_HOST. This allows each deployment environment (local, staging, production) to specify the correct number of proxies.

Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: palvelutarjotin/settings.py#L451

Potential issue: The setting `AXES_IPWARE_PROXY_COUNT` is hardcoded to `1`. This assumes
a fixed infrastructure with exactly one reverse proxy, which is not guaranteed across
all deployment environments. In local development environments without a proxy, this
configuration makes the `django-axes` rate-limiting feature vulnerable to IP spoofing,
as it will incorrectly trust a client-supplied `X-Forwarded-For` header. Conversely, in
production environments with more than one proxy, it will identify an intermediate
proxy's IP instead of the actual client's, undermining the effectiveness of rate
limiting.


LOGGING = {
"version": 1,
Expand Down
Loading