()
| 1441 | # This helps correct URL generation (scheme/host) and client IP for security logs. |
| 1442 | # Only trust X-Forwarded-* when the direct peer is loopback (cloudflared/tor connect locally). |
| 1443 | class _LoopbackProxyFix: |
| 1444 | def __init__(self, wsgi_app): |
| 1445 | self.app = wsgi_app |
| 1446 | self._pf = ProxyFix(wsgi_app, x_for=1, x_proto=1, x_host=1) |
| 1447 | |
| 1448 | def __call__(self, environ, start_response): |
| 1449 | ra = (environ.get("REMOTE_ADDR") or "").strip() |
| 1450 | if ra in ("127.0.0.1", "::1"): |
| 1451 | return self._pf(environ, start_response) |
| 1452 | # Strip forwarded headers to prevent spoofing when accessed directly on LAN. |
| 1453 | for k in ("HTTP_X_FORWARDED_FOR", "HTTP_X_FORWARDED_PROTO", "HTTP_X_FORWARDED_HOST", "HTTP_X_FORWARDED_PORT"): |
no test coverage detected