Our reaction defenses for Forgejo are useless #293

New issue

Closed

opened 2025-08-27 19:04:55 +00:00 by raito · 1 comment

raito commented

2025-08-27 19:04:55 +00:00

(Migrated from git.lix.systems)

Aug 27 19:03:12 lix forgejo[3758191]: router: slow      GET /lix-project/lix/issues?
assignee=60&labels=121%2C154%2C155%2C156%2C161%2C192%2C193%2C194%2C196%2C199%2C200%2C201%2C202%2C207%2C233%2C235%2C243%2C248%2C251&milestone=55&poster=0&project=19&sort=latest&state=closed&type=all for 127.0.0.1:0, elapsed 3014.2ms @ repo/issue.go:509(repo.Issues)

Here's the sort of log lines we have, notice that we are not able to see through the real IP used to contact us.

I suppose this is a X-Forward shaped bug related to NGINX.

``` Aug 27 19:03:12 lix forgejo[3758191]: router: slow GET /lix-project/lix/issues? assignee=60&labels=121%2C154%2C155%2C156%2C161%2C192%2C193%2C194%2C196%2C199%2C200%2C201%2C202%2C207%2C233%2C235%2C243%2C248%2C251&milestone=55&poster=0&project=19&sort=latest&state=closed&type=all for 127.0.0.1:0, elapsed 3014.2ms @ repo/issue.go:509(repo.Issues) ``` Here's the sort of log lines we have, notice that we are not able to see through the real IP used to contact us. I suppose this is a X-Forward shaped bug related to NGINX.

raito commented

2025-08-27 20:52:28 +00:00

(Migrated from git.lix.systems)

There were no proxy headers I think in NGINX. I implemented a fix at 20:33:00 CEST, and all IPs came.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

afnix/infra#293

No description provided.

Rows
Columns