hardening: identify remote webseer servers by their connection address - #71
Open
somethingwithproof wants to merge 1 commit into
Open
Conversation
remote.php authorized the server-to-server actions by comparing the caller IP to the registered servers, but read that IP from the X-Forwarded-For request header before REMOTE_ADDR. A forwarded header is set by the client, so use REMOTE_ADDR, the real connection peer, for the comparison. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
somethingwithproof
force-pushed
the
hardening/remote-peer-identification
branch
from
August 30, 2026 22:57
5974e69 to
4663a89
Compare
This was referenced Aug 30, 2026
There was a problem hiding this comment.
🟢 Approval recommended
The change is small, security-improving, and consistent with the stated goal of avoiding spoofable forwarded headers for authorization.
Pull request overview
This PR hardens remote.php’s server-to-server authorization by identifying the calling peer using the actual connection address (REMOTE_ADDR) instead of trusting client-controlled forwarded headers, reducing the risk of IP spoofing in authorization checks.
Changes:
- Replace
X-Forwarded-For/HTTP_X_FORWARDED_FOR-based peer identification with$_SERVER['REMOTE_ADDR']. - Add an explanatory comment documenting why forwarded headers are not trusted for authorization.
- Document the security hardening in
CHANGELOG.md.
File summaries
| File | Description |
|---|---|
| remote.php | Uses REMOTE_ADDR for peer identification to prevent forwarded-header spoofing in server authorization. |
| CHANGELOG.md | Notes the security hardening change for the 3.2 release notes. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
remote.phpauthorizes the server-to-server actions (heartbeat, host-down log, enable/disable and add/update URL) by comparing the caller's IP to the registeredplugin_webseer_servers. It read that IP from theX-Forwarded-Forheader before falling back toREMOTE_ADDR.A forwarded header is set by the client, so it should not be trusted to identify the peer. This switches the comparison to
REMOTE_ADDR, the real connection address.No behaviour change for direct server-to-server connections. If a deployment fronts these servers with a trusted proxy, the proxy address is now what's matched (the intended, non-spoofable behaviour).
php -land php-cs-fixer clean.Closes #72