3 ms·
> As you can see, X-FORWARDED-FOR can be set to an arbitrary value, so you can bypass IP limitation requests during scrapping or more dangerous IP verification
by oefrha 6y ago
> As you can see, X-FORWARDED-FOR can be set to an arbitrary value, so you can bypass IP limitation requests during scrapping or more dangerous IP verification during a login procedure … The origin IP is not forwarded to the website, so the only way to block this kind of request on your server is to filter on CF-WORKER header.
X-Forwarded-For should always be treated as forged at least for security purposes (except the hops set by reverse proxies under your control). If you do IP whitelisting based on untrusted X-Forwarded-For you’re doing it terribly wrong.
- daurnimator 6y agoA lot of people just verify that X-Forwarded-For matches a Cloudflare-owned IP. As this post demonstrates, you need to verify against the cloudflare origin pull CA (see https://support.cloudflare.com/hc/en-us/articles/204899617-Authenticated-Origin-Pulls https://support.cloudflare.com/hc/en-us/articles/204899617-A... )
- tgsovlerkhgsel 6y agoI suspect that the idea here is that XFF is supposed to be trusted, because it is supposed to come from Cloudflare.
- userbinator 6y agoFor a very long time, XFF-spoofing was a trick to get past journal subscriptions and other paywalls. I don't feel so guilty about disclosing this here now, as a lot of them have (unfortunately) blocked that route. No doubt a few popular bookz/journalz sites owe at least some of their content to this technique. But it's something to try and might still work on a few of them...
- RiceAndWaters 6y agoHey, I saw one of your past comments where you mentioned being (briefly) active in the bookz scene in the past. I really want to know more about this scene. If it's not too much work for you, please contact me at Bibliohoarding@tutanota.com Thank you!