fix: take the recorded address from the end of the forwarding header

Reading only remoteAddr was honest but inert: behind the ingress it is a
cluster-internal address, so every session on Cloud would have read 'Local
network' and the whole GeoIP apparatus - the database mount, the download, the
deployment change - would have shown nothing.

The binary choice was the mistake. A proxy appends the address it actually saw
to X-Forwarded-For while a client can only prepend entries of its own, so
counting from the end is unforgeable given a known number of hops. That number
is now configuration: 0, the default, keeps using the connection's address and
is right for anyone running Tolgee without a proxy; the deployment sets 1 for
nginx-ingress. Setting it too high is the failure mode, and the property says so.

Tests cover the case that matters - a client prepending its own entry cannot
displace the address the proxy observed - plus both fallbacks.

Author: JanCizmar

backend/data/src/main/kotlin/io/tolgee/configuration/tolgee/SessionAuditProperties.kt

@@ -49,6 +49,18 @@ class SessionAuditProperties {
   )
   var purgeEnabled: Boolean = true
 
+  @DocProperty(
+    description =
+      "How many reverse proxies sit in front of Tolgee. Addresses recorded as evidence - the " +
+        "session list and the authentication audit log - are read this many entries from the end " +
+        "of `X-Forwarded-For`, because a proxy appends the address it actually saw while a client " +
+        "can only prepend entries of its own. Leave at 0 when nothing proxies Tolgee, which uses " +
+        "the connection's address instead; set it to the number of trusted hops otherwise. Getting " +
+        "this too high lets clients forge their own address.",
+    defaultExplanation = "0, no proxy",
+  )
+  var trustedProxyCount: Int = 0
+
   @DocProperty(
     description =
       "Absolute path to a MaxMind-format GeoIP city database (`.mmdb`), used to show an approximate " +

backend/data/src/main/kotlin/io/tolgee/util/RequestIpProvider.kt

@@ -1,28 +1,45 @@
 package io.tolgee.util
 
+import io.tolgee.configuration.tolgee.TolgeeProperties
 import org.springframework.stereotype.Component
 import org.springframework.web.context.request.RequestContextHolder
 import org.springframework.web.context.request.ServletRequestAttributes
 
 @Component
-class RequestIpProvider {
+class RequestIpProvider(
+  private val tolgeeProperties: TolgeeProperties,
+) {
   /**
-   * The address the connection actually came from, which a client cannot choose - unlike the
-   * forwarding headers [getClientIp] reads. Anything that ends up in the audit trail or in front of
-   * a user as evidence uses this, the same value the rate limiter buckets on.
+   * The address to record as evidence - what the session list shows and the audit log keeps.
    *
-   * Behind a proxy this is the proxy's own address, which is useless for locating anyone but is at
-   * least never a lie. `server.forward-headers-strategy` would make the container derive it from
-   * `X-Forwarded-For` instead - do not set it unless the proxy in front is known to overwrite that
-   * header rather than append to it, because otherwise it hands the client back control of this
-   * value and of the rate limiter's bucket key.
+   * A proxy appends the address it actually observed to `X-Forwarded-For`, while a client can only
+   * prepend entries of its own, so counting from the end of the list is what makes the value
+   * unforgeable. With no proxy configured the connection's own address is used, which is the same
+   * value the rate limiter buckets on. Never the front of the list: that entry is whatever the
+   * caller chose to send.
    */
   fun getTrustedClientIp(): String? {
-    if (RequestContextHolder.getRequestAttributes() == null) {
-      return null
-    }
-    val request = (RequestContextHolder.getRequestAttributes() as ServletRequestAttributes).request
-    return request.remoteAddr?.take(MAX_IP_LENGTH)
+    val request = currentRequest() ?: return null
+    val hops = tolgeeProperties.authentication.sessionAudit.trustedProxyCount
+    if (hops <= 0) return request.remoteAddr?.take(MAX_IP_LENGTH)
+
+    val forwarded =
+      request
+        .getHeader("X-Forwarded-For")
+        ?.split(",")
+        ?.map { it.trim() }
+        ?.filter { it.isNotEmpty() }
+        ?: return request.remoteAddr?.take(MAX_IP_LENGTH)
+
+    return forwarded
+      .getOrNull(forwarded.size - hops)
+      ?.take(MAX_IP_LENGTH)
+      ?: request.remoteAddr?.take(MAX_IP_LENGTH)
+  }
+
+  private fun currentRequest(): jakarta.servlet.http.HttpServletRequest? {
+    val attributes = RequestContextHolder.getRequestAttributes() ?: return null
+    return (attributes as ServletRequestAttributes).request
   }
 
   fun getClientIp(): String? {

backend/data/src/test/kotlin/io/tolgee/util/RequestIpProviderTest.kt

@@ -0,0 +1,71 @@
+package io.tolgee.util
+
+import io.tolgee.configuration.tolgee.AuthenticationProperties
+import io.tolgee.configuration.tolgee.SessionAuditProperties
+import io.tolgee.configuration.tolgee.TolgeeProperties
+import io.tolgee.testing.assert
+import org.junit.jupiter.api.AfterEach
+import org.junit.jupiter.api.Test
+import org.springframework.mock.web.MockHttpServletRequest
+import org.springframework.web.context.request.RequestContextHolder
+import org.springframework.web.context.request.ServletRequestAttributes
+
+class RequestIpProviderTest {
+  @AfterEach
+  fun cleanup() {
+    RequestContextHolder.resetRequestAttributes()
+  }
+
+  @Test
+  fun `without a proxy it reports the address the connection came from`() {
+    request(remoteAddr = "203.0.113.7", forwardedFor = "8.8.8.8")
+
+    provider(trustedProxyCount = 0).getTrustedClientIp().assert.isEqualTo("203.0.113.7")
+  }
+
+  /**
+   * The whole point of counting from the end: a client that prepends its own entry cannot push
+   * itself into the position the proxy writes.
+   */
+  @Test
+  fun `behind one proxy a forged entry cannot displace the observed address`() {
+    request(remoteAddr = "10.0.0.1", forwardedFor = "8.8.8.8, 203.0.113.7")
+
+    provider(trustedProxyCount = 1).getTrustedClientIp().assert.isEqualTo("203.0.113.7")
+  }
+
+  @Test
+  fun `a header shorter than the configured hops falls back to the connection`() {
+    request(remoteAddr = "10.0.0.1", forwardedFor = "203.0.113.7")
+
+    provider(trustedProxyCount = 2).getTrustedClientIp().assert.isEqualTo("10.0.0.1")
+  }
+
+  @Test
+  fun `a missing header falls back to the connection`() {
+    request(remoteAddr = "10.0.0.1", forwardedFor = null)
+
+    provider(trustedProxyCount = 1).getTrustedClientIp().assert.isEqualTo("10.0.0.1")
+  }
+
+  private fun request(
+    remoteAddr: String,
+    forwardedFor: String?,
+  ) {
+    val request = MockHttpServletRequest()
+    request.remoteAddr = remoteAddr
+    forwardedFor?.let { request.addHeader("X-Forwarded-For", it) }
+    RequestContextHolder.setRequestAttributes(ServletRequestAttributes(request))
+  }
+
+  private fun provider(trustedProxyCount: Int): RequestIpProvider {
+    val properties =
+      TolgeeProperties().apply {
+        authentication =
+          AuthenticationProperties().apply {
+            sessionAudit = SessionAuditProperties().apply { this.trustedProxyCount = trustedProxyCount }
+          }
+      }
+    return RequestIpProvider(properties)
+  }
+}