Skip to content

hardening: identify remote webseer servers by their connection address - #71

Open
somethingwithproof wants to merge 1 commit into
Cacti:developfrom
somethingwithproof:hardening/remote-peer-identification
Open

hardening: identify remote webseer servers by their connection address#71
somethingwithproof wants to merge 1 commit into
Cacti:developfrom
somethingwithproof:hardening/remote-peer-identification

Conversation

@somethingwithproof

@somethingwithproof somethingwithproof commented Aug 30, 2026

Copy link
Copy Markdown
Member

remote.php authorizes the server-to-server actions (heartbeat, host-down log, enable/disable and add/update URL) by comparing the caller's IP to the registered plugin_webseer_servers. It read that IP from the X-Forwarded-For header before falling back to REMOTE_ADDR.

A forwarded header is set by the client, so it should not be trusted to identify the peer. This switches the comparison to REMOTE_ADDR, the real connection address.

No behaviour change for direct server-to-server connections. If a deployment fronts these servers with a trusted proxy, the proxy address is now what's matched (the intended, non-spoofable behaviour). php -l and php-cs-fixer clean.

Closes #72

remote.php authorized the server-to-server actions by comparing the caller IP to
the registered servers, but read that IP from the X-Forwarded-For request header
before REMOTE_ADDR. A forwarded header is set by the client, so use REMOTE_ADDR,
the real connection peer, for the comparison.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The change is small, security-improving, and consistent with the stated goal of avoiding spoofable forwarded headers for authorization.

Pull request overview

This PR hardens remote.php’s server-to-server authorization by identifying the calling peer using the actual connection address (REMOTE_ADDR) instead of trusting client-controlled forwarded headers, reducing the risk of IP spoofing in authorization checks.

Changes:

  • Replace X-Forwarded-For/HTTP_X_FORWARDED_FOR-based peer identification with $_SERVER['REMOTE_ADDR'].
  • Add an explanatory comment documenting why forwarded headers are not trusted for authorization.
  • Document the security hardening in CHANGELOG.md.
File summaries
File Description
remote.php Uses REMOTE_ADDR for peer identification to prevent forwarded-header spoofing in server authorization.
CHANGELOG.md Notes the security hardening change for the 3.2 release notes.
Review details
  • Files reviewed: 2/2 changed files
  • Comments generated: 0
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

identify remote webseer servers by their connection address

2 participants