openhands
f0c27eb815
- resolveClientIp: trust cf-connecting-ip only behind cf-ray/cdn-loop, use nginx x-real-ip otherwise (anti-spoof) - antiddos-config: Redis-backed live config (antiddos:config) with 30s cache, 13 ANTI_DDOS_* env vars - ddos-guard: consume tunable rates/tiers via getAntiddosConfig - admin panel at /admin/devops/antiddos (save/reset/unban actions, PERMS.SETTINGS_VIEW) - register new admin page in housekeeping migration matrix (146 -> 147)
33 lines
1.3 KiB
TypeScript
33 lines
1.3 KiB
TypeScript
/**
|
|
* Cloudflare presence detection.
|
|
*
|
|
* Only headers that a Cloudflare edge adds to every transit are treated as
|
|
* proof the request passed through Cloudflare: `CF-Ray` is stamped by the
|
|
* edge and `CDN-Loop: cloudflare` is prepended on CDN transits. A bare
|
|
* `CF-Connecting-IP` is *not* sufficient — a direct client to the origin can
|
|
* send that header itself — so it is only trusted in combination with one of
|
|
* the edge-stamped fingerprints.
|
|
*/
|
|
export function isCloudflareProxied(headers: Pick<Headers, "get">): boolean {
|
|
const ray = headers.get("cf-ray")?.trim();
|
|
if (ray) return true;
|
|
const loop = headers.get("cdn-loop")?.trim();
|
|
if (loop) return true;
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Which client-IP header the stack should trust for a given request. When the
|
|
* request demonstrably transited Cloudflare, `CF-Connecting-IP` carries the
|
|
* real client; otherwise only the ingress-set `X-Real-IP` / `X-Forwarded-For`
|
|
* (derived by nginx from the actual TCP peer) may be trusted.
|
|
*/
|
|
export function preferredClientIpHeader(
|
|
headers: Pick<Headers, "get">,
|
|
): "cf-connecting-ip" | "x-forwarded-for" | "x-real-ip" | "none" {
|
|
if (isCloudflareProxied(headers)) return "cf-connecting-ip";
|
|
if (headers.get("x-real-ip")?.trim()) return "x-real-ip";
|
|
if (headers.get("x-forwarded-for")?.trim()) return "x-forwarded-for";
|
|
return "none";
|
|
}
|