{"action":"created","issue":{"url":"https://api.github.com/repos/Dreamsolution/django-auth-policy/issues/10","labels_url":"https://api.github.com/repos/Dreamsolution/django-auth-policy/issues/10/labels{/name}","comments_url":"https://api.github.com/repos/Dreamsolution/django-auth-policy/issues/10/comments","events_url":"https://api.github.com/repos/Dreamsolution/django-auth-policy/issues/10/events","html_url":"https://github.com/Dreamsolution/django-auth-policy/issues/10","id":110481546,"number":10,"title":"IP Address Lockout Bypass","user":{"login":"neonbunny","id":6201399,"avatar_url":"https://avatars.githubusercontent.com/u/6201399?v=3","gravatar_id":"","url":"https://api.github.com/users/neonbunny","html_url":"https://github.com/neonbunny","followers_url":"https://api.github.com/users/neonbunny/followers","following_url":"https://api.github.com/users/neonbunny/following{/other_user}","gists_url":"https://api.github.com/users/neonbunny/gists{/gist_id}","starred_url":"https://api.github.com/users/neonbunny/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/neonbunny/subscriptions","organizations_url":"https://api.github.com/users/neonbunny/orgs","repos_url":"https://api.github.com/users/neonbunny/repos","events_url":"https://api.github.com/users/neonbunny/events{/privacy}","received_events_url":"https://api.github.com/users/neonbunny/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-10-08T15:54:35Z","updated_at":"2015-10-08T16:09:58Z","closed_at":null,"body":"The code which determines the source IP address of a login uses the following logic:\r\n\r\n```\r\nremote_addr = (self.request.META.get('HTTP_X_REAL_IP') or self.request.META.get('REMOTE_ADDR'))\r\n```\r\n\r\nThis means an attacker can override their source IP address by supplying an X-Real-IP header containing an IP address different than their own (assuming the attacker's header isn't replaced/stripped by an intermediate system). A brute force attack is therefore still possible by cycling through values in this header.\r\n\r\nThis library should only support a single mechanism of determining the visitor's IP address which is configured by the library user to match the deployment environment (e.g. direct Internet connect or behind a load balancer)"},"comment":{"url":"https://api.github.com/repos/Dreamsolution/django-auth-policy/issues/comments/146595137","html_url":"https://github.com/Dreamsolution/django-auth-policy/issues/10#issuecomment-146595137","issue_url":"https://api.github.com/repos/Dreamsolution/django-auth-policy/issues/10","id":146595137,"user":{"login":"rudolphfroger","id":767447,"avatar_url":"https://avatars.githubusercontent.com/u/767447?v=3","gravatar_id":"","url":"https://api.github.com/users/rudolphfroger","html_url":"https://github.com/rudolphfroger","followers_url":"https://api.github.com/users/rudolphfroger/followers","following_url":"https://api.github.com/users/rudolphfroger/following{/other_user}","gists_url":"https://api.github.com/users/rudolphfroger/gists{/gist_id}","starred_url":"https://api.github.com/users/rudolphfroger/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rudolphfroger/subscriptions","organizations_url":"https://api.github.com/users/rudolphfroger/orgs","repos_url":"https://api.github.com/users/rudolphfroger/repos","events_url":"https://api.github.com/users/rudolphfroger/events{/privacy}","received_events_url":"https://api.github.com/users/rudolphfroger/received_events","type":"User","site_admin":false},"created_at":"2015-10-08T16:09:58Z","updated_at":"2015-10-08T16:09:58Z","body":"Thanks for you feedback. Do you think it would be enough to add a configuration setting to determine the HTTP header to use?"}}