fix: spoofing of X-Forwarded-For

README.md

@@ -71,6 +71,11 @@ debug: false
 # Disable sniffing the files to detect their content type. Default is 'false'.
 noSniff: false
 
+# Whether the server runs behind a trusted proxy or not. When this is true,
+# the header X-Forwarded-For will be used for logging the remote addresses
+# of logging attempts (if available).
+behindProxy: false
+
 # The directory that will be able to be accessed by the users when connecting.
 # This directory will be used by users unless they have their own 'directory' defined.
 # Default is '.' (current directory).

lib/config.go

@@ -33,6 +33,7 @@ type Config struct {
 	Prefix          string
 	NoSniff         bool
 	NoPassword      bool
+	BehindProxy     bool
 	Log             Log
 	CORS            CORS
 	Users           []User

lib/handler.go

@@ -18,6 +18,7 @@ type handlerUser struct {
 
 type Handler struct {
 	noPassword  bool
+	behindProxy bool
 	user        *handlerUser
 	users       map[string]*handlerUser
 }
@@ -25,6 +26,7 @@ type Handler struct {
 func NewHandler(c *Config) (http.Handler, error) {
 	h := &Handler{
 		noPassword:  c.NoPassword,
+		behindProxy: c.BehindProxy,
 		user: &handlerUser{
 			User: User{
 				UserPermissions: c.UserPermissions,
@@ -85,7 +87,7 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("WWW-Authenticate", `Basic realm="Restricted"`)
 
 		// Retrieve the real client IP address using the updated helper function
-		remoteAddr := getRealRemoteIP(r)
+		remoteAddr := getRealRemoteIP(r, h.behindProxy)
 
 		// Gets the correct user for this request.
 		username, password, ok := r.BasicAuth()
@@ -166,13 +168,14 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 }
 
 // getRealRemoteIP retrieves the client's actual IP address, considering reverse proxies.
-func getRealRemoteIP(r *http.Request) string {
+func getRealRemoteIP(r *http.Request, behindProxy bool) string {
-    ip := r.Header.Get("X-Forwarded-For")
+	if behindProxy {
-    if ip == "" {
+		if ip := r.Header.Get("X-Forwarded-For"); ip != "" {
-        ip = r.RemoteAddr
-    }
 			return ip
 		}
+	}
+	return r.RemoteAddr
+}
 
 type responseWriterNoBody struct {
 	http.ResponseWriter