Skip to content

IP_SECURITY_FIX.md

Latest commit

 

History

History
94 lines (73 loc) · 3.13 KB

IP_SECURITY_FIX.md

File metadata and controls

94 lines (73 loc) · 3.13 KB
Raw

IP Security Hardening for Audit Trail

Problem

The audit trail system was vulnerable to IP spoofing attacks because it trusted x-forwarded-for headers without proper proxy validation.

Vulnerability

  • audit-trail.service.ts line 256: Used x-forwarded-for header directly
  • logging.interceptor.ts line 36: Used x-forwarded-for header directly
  • No trust proxy configuration in Express/NestJS

Solution Implemented

1. Trust Proxy Configuration (src/main.ts)

// Configure trust proxy for IP extraction
// Only trust specific proxy IPs from environment variable
const trustedProxies = process.env.TRUSTED_PROXIES?.split(',')?.map(ip => ip.trim()) || [];
if (trustedProxies.length > 0) {
  app.set('trust proxy', trustedProxies);
} else {
  // Default: trust no proxies (disable x-forwarded-for processing)
  app.set('trust proxy', false);
}

2. Secure IP Extraction (src/audit/services/audit-trail.service.ts)

private getClientIp(): string | undefined {
  if (!this.request) return undefined;

  // Use req.ip which respects trust proxy configuration
  // Falls back to socket remoteAddress for direct connections
  return this.request.ip || this.request.socket?.remoteAddress;
}

3. Secure Logging Interceptor (src/logger/logging.interceptor.ts)

ip: request.ip, // Only uses req.ip which respects trust proxy settings

Environment Configuration

For Production with Trusted Proxies

TRUSTED_PROXIES=127.0.0.1,10.0.0.1,192.168.1.100

For Development/Direct Connections

# No TRUSTED_PROXIES needed - defaults to false (secure)

Security Benefits

  1. IP Spoofing Prevention: Direct clients cannot spoof their IP address
  2. Trusted Proxy Support: Only configured proxies can forward real client IPs
  3. Forensic Integrity: Audit logs contain accurate client IP addresses
  4. Backward Compatibility: Works with both direct and proxied connections

Testing

Test Scenarios Covered

  • ✅ Direct connection with spoofed headers (should use real IP)
  • ✅ Trusted proxy with valid headers (should use forwarded IP)
  • ✅ Multiple proxy chain handling
  • ✅ Fallback to socket.remoteAddress
  • ✅ Attack scenarios (basic spoofing, CF header spoofing)

Running Tests

npm test -- src/audit/services/audit-trail.service.spec.ts

Acceptance Criteria Met

  • ✅ Spoofed forwarded header from direct client is ignored
  • ✅ Only trusted proxies can forward real client IPs
  • ✅ Audit logs contain accurate IP addresses
  • ✅ Tests verify spoofing attempts are blocked

Migration Notes

  1. No Breaking Changes: Existing functionality preserved
  2. Environment Variable: Add TRUSTED_PROXIES for production if using load balancers
  3. Default Secure: No configuration needed for direct deployments
  4. Audit Log Integrity: Existing logs maintain their recorded IPs

Deployment Checklist

  • Set TRUSTED_PROXIES environment variable if using load balancers/reverse proxies
  • Test with actual proxy infrastructure
  • Verify audit logs show correct IPs in production
  • Run security tests to confirm spoofing protection