Drupal Flood Control Doesn't Use Correct IP Address

Viewed 16

In settings.php I've done the following:

/* Turn on reverse proxy */

$settings['reverse_proxy'] = TRUE;

/* Set reverse proxy (load balancer) address */

$settings['reverse_proxy_addresses'] = ['172.17.21.5']; //test-bnc4-web1

/* Enabled trusted headers */

$settings['reverse_proxy_trusted_headers'] = \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_FOR | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_HOST | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PORT | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PROTO | \Symfony\Component\HttpFoundation\Request::HEADER_FORWARDED;

I'm still not getting the correct client IP in the log when a user fails to login because of an invalid username. It is reporting the second IP address in $_SERVER['X_FORWARDED_FOR'] where $_SERVER['X_FORWARDED_FOR'] = '167.160.79.230, 149.32.195.197' The first IP is the correct one. The second is a switch.

This is important if an IP gets blocked.

0 Answers
Related