plug_ip_whitelist v1.1.0 Plug.IpWhitelist.HerokuRemoteIp View Source
This Plug is for use on applications running on Heroku. It injects the ip
address of the request into the the remote_ip attribute on the Plug.
It should be included in the Plug pipeline before the IpWhitelistEnforcer
.
We can get the originating request IP from the X-Forwarded-For header, which
usually contains a single ip address ie:
X-Forwarded-For: <the real request ip>
It will contain list of ip addresses if something besides the heroku router modified the X-Forwarded-For header earlier in the request chain. An example of when this would happen is if an attacker were trying to spoof the IP address. The heroku router handles this by including a comma-seperated list of ip addresses in the X-Forwarded-For header, where the last ip address in the list is the originating request IP, ie:
X-Forwarded-For: <spoofed request ip>, <real request ip>
So, we make the assumption that the heroku router isn’t compromised and that nothing between the heroku router and our application has been compromised. Given that assumption, we can trust that the last ip address in the list is the actual originating request IP, which we want to compare against our whitelist See also: https://devcenter.heroku.com/articles/http-routing#heroku-headers
Link to this section Summary
Functions
Find the request IP address as described in the module documentation.
Set the request IP address that is discovered as the remote_ip
attribute
on the returned Plug.Conn
Initialize the plug with options (there are none)
Link to this section Functions
Find the request IP address as described in the module documentation.
Set the request IP address that is discovered as the remote_ip
attribute
on the returned Plug.Conn
Initialize the plug with options (there are none)