Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support a more generic updaters control logic #33

Open
fgm opened this issue May 23, 2019 · 0 comments
Open

Support a more generic updaters control logic #33

fgm opened this issue May 23, 2019 · 0 comments

Comments

@fgm
Copy link
Owner

fgm commented May 23, 2019

Since v0.3.2, the packages has been supporting restricting the servers allowed to send update requests to Meteor.

However, the current logic used for this relies on the IP at the other end of the HTTP request, which will usually be the last proxy on the chain from the user agent to Meteor, instead of being a reliable indicator of the user IP.

The code should allow:

  • relying on a chain of forwarding HTTP headers from a chain of trusted proxy IPs starting at the socket IP
  • disabling the mechanisme OR not allowing any updater, so it's not just a matter of giving one meaning to an empty updaters array.

See https://github.com/symfony/symfony/search?q=%22public+function+getClientIps%28%29%22&unscoped_q=%22public+function+getClientIps%28%29%22 for a reasonably safe way to implement this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant