You are viewing a plain text version of this content. The canonical link for it is here.

Posted to notifications@couchdb.apache.org by "DanielRamosAcosta (via GitHub)" <gi...@apache.org> on 2026/06/28 18:44:07 UTC

[PR] Let auth lockout identify clients by a trusted proxy header [couchdb]

DanielRamosAcosta opened a new pull request, #6053:
URL: https://github.com/apache/couchdb/pull/6053

## Overview

The auth lockout from 3.4 identifies clients by the socket peer. Behind a reverse proxy or CDN that peer is the proxy, so the lockout stops working: an attacker rotates the upstream IP, and clients sharing a proxy egress IP can lock each other out.

This adds an optional `[chttpd_auth_lockout] client_ip_header` setting that names the header carrying the real client IP (`X-Forwarded-For`, `X-Real-IP`, `CF-Connecting-IP`). The first address is used if the header holds a list. Unset by default, so current behaviour is unchanged.

## Testing recommendations

`make eunit apps=couch suites=couch_auth_lockout` and `make elixir tests=test/elixir/test/auth_lockout_test.exs`.

The integration test sets `client_ip_header = X-Forwarded-For` and checks that one forwarded client gets locked out (403) while another still gets 401, so the lockout keys on the header and not on the shared socket peer.

## Related Issues or Pull Requests

Fixes #6052

## Checklist

- [ ] This is my own work, I did not use AI, LLM's or similar technology
- [x] Code is written and works correctly
- [x] Changes are covered by tests
- [x] Any new configurable parameters are documented in `rel/overlay/etc/default.ini`
- [x] Documentation changes were made in the `src/docs` folder
- [ ] Documentation changes were backported (separated PR) to affected branches

## Note on AI assistance

I used AI to help me understand the codebase and explore the approach. I reviewed and validated the design, the tests and the final code myself, so this is not an unreviewed AI dump. I am Spanish and my English is not great, so I also used AI to translate this message. Flagging it for transparency.

--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Let auth lockout identify clients by a trusted proxy header [couchdb]

Posted by "rnewson (via GitHub)" <gi...@apache.org>.

rnewson commented on PR #6053:
URL: https://github.com/apache/couchdb/pull/6053#issuecomment-4831933621

   thank you for the attempt but our policy on AI is clear, in the Pull Request comment that you were presented with;
   
   ```
        Artificial Intelligence and Large Language Models Contributions Policy
   
        It is expressly forbidden to contribute material generated by
        AI, LLMs, and similar technologies, to the CouchDB project. 
        This includes, but is not limited to, source code, documentation,
        commit messages, or any other areas of the project.
   ```
   
   Someone in the couchdb team will make a PR in due course.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Let auth lockout identify clients by a trusted proxy header [couchdb]

Posted by "rnewson (via GitHub)" <gi...@apache.org>.

rnewson closed pull request #6053: Let auth lockout identify clients by a trusted proxy header
URL: https://github.com/apache/couchdb/pull/6053


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Let auth lockout identify clients by a trusted proxy header [couchdb]

Posted by "DanielRamosAcosta (via GitHub)" <gi...@apache.org>.

DanielRamosAcosta commented on PR #6053:
URL: https://github.com/apache/couchdb/pull/6053#issuecomment-4827044698

   Two refactors I deliberately left out to keep this diff small and easy to review:
   
   1. The client IP resolution lives in `couch_auth_lockout`, but conceptually it belongs to the HTTP layer where `#httpd.peer` is computed (`chttpd.erl`). Moving it there would also give access logging and external handlers the real client IP, instead of only the lockout. I kept it local on purpose, matching the "simplest move" suggested in #6052.
   
   2. The lockout identity `{Peer, UserName, UserSalt}` is a recurring tuple across `is_locked_out_int/4` and `lockout/3`, and `UserName`/`UserSalt` travel together through the public API. That predates this change and touching it would widen the diff into the exported API, so I left it as is.
   
   Happy to follow up on either in a separate PR if there is interest.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org