feat: django-axes prefers forwarded ip address#481
Conversation
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
|
KULTUS-API branch is deployed to platta: https://kultus-pr481.api.dev.hel.ninja 🚀🚀🚀 |
charn
force-pushed
the
PT-2026/django-axes-config
branch
from
c45355c to
730b7e4
Compare
Refs: PT-2026
charn
force-pushed
the
PT-2026/django-axes-config
branch
from
730b7e4 to
cda2b96
Compare
Prioritize `HTTP_X_FORWARDED_FOR` for django-axes similar to audit logs with the get_client_ip. Refs: PT-2026
charn
force-pushed
the
PT-2026/django-axes-config
branch
from
cda2b96 to
c62e9b0
Compare
| AXES_FAILURE_LIMIT = 5 | ||
| AXES_COOLOFF_TIME = 1 # hour after locked out, user will be able to attempt login | ||
| AXES_IPWARE_META_PRECEDENCE_ORDER = ["HTTP_X_FORWARDED_FOR", "REMOTE_ADDR"] | ||
| AXES_IPWARE_PROXY_COUNT = 1 |
There was a problem hiding this comment.
Bug: The AXES_IPWARE_PROXY_COUNT is hardcoded to 1, creating an IP spoofing vulnerability in local development and causing incorrect IP detection in multi-proxy environments.
Severity: HIGH
Suggested Fix
Make the AXES_IPWARE_PROXY_COUNT setting configurable via an environment variable, similar to other infrastructure-dependent settings like USE_X_FORWARDED_HOST. This allows each deployment environment (local, staging, production) to specify the correct number of proxies.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: palvelutarjotin/settings.py#L451
Potential issue: The setting `AXES_IPWARE_PROXY_COUNT` is hardcoded to `1`. This assumes
a fixed infrastructure with exactly one reverse proxy, which is not guaranteed across
all deployment environments. In local development environments without a proxy, this
configuration makes the `django-axes` rate-limiting feature vulnerable to IP spoofing,
as it will incorrectly trust a client-supplied `X-Forwarded-For` header. Conversely, in
production environments with more than one proxy, it will identify an intermediate
proxy's IP instead of the actual client's, undermining the effectiveness of rate
limiting.
|
|
KULTUS-API branch is deployed to platta: https://kultus-pr481.api.dev.hel.ninja 🚀🚀🚀 |
2 participants
Prioritize
HTTP_X_FORWARDED_FORfor django-axes similar to audit logs with theget_client_ip.https://django-axes.readthedocs.io/en/latest/4_configuration.html#configuring-reverse-proxies
Refs: PT-2026