[Feature Request] handle CF-Connecting-IP when running behind Cloudflare

[karuboniru]

Since Vercel don't support ipv6 now, you need a reverse proxy (like Cloudflare) to make a waline instance to be accessible via ipv6. But here comes a problem:

When running behind reverse proxy, waline records origin ip as Cloudflare's.

Letting waline handle CF-Connecting-IP or X-Forwarded-For headers can help to solve this (but be careful anyone can mock those headers to spam, recording also origin ip or setting a trusted reverse ip list should be needed.)

[Mister-Hope]

Emm, though it's a nice catch, but I would recommend you use self host env if you need ipv6.

[karuboniru]

Yes, self-hosting will solve any problem but Cloudflare+Vercel solution is freeeeeeee~ !

If I have free time then (sigh), I may try to implement such feature, but putting a Feature Request here is for anyone who are willing to do this instead of me. 🤣

[lizheming]

Waline has been read X-Forwarded-For header to get user's ip (check by the following link), so are you sure the header works fine? If it's not ok, maybe we should expose proxyIpHeader options to user to custom proxy header name.

https://github.com/walinejs/waline/blob/main/packages/server/src/controller/comment.js#L234
https://github.com/walinejs/waline/blob/main/packages/server/index.js#L12
https://github.com/thinkjs/thinkjs/blob/c3776be141048aaad77118dbd8888521c0fb53d4/lib/loader.js#L35
https://github.com/thinkjs/thinkjs/blob/c3776be141/lib/think.js#L17
https://github.com/koajs/koa/blob/eb51cf5fb35b39592a050b25fd261a574f547cfa/lib/application.js#L54
https://github.com/koajs/koa/blob/eb51cf5fb3/lib/request.js#L433-L459

[lizheming]

What i mean is Waline has handled X-Forwarded-For header, are you sure cf set X-Forwarded-For header with user's ip? What the proxy ip record header name is X-Forwarded-For or CF-Connecting-IP should be checked.

[karuboniru]

Both, see their documentation.
If there is no further proxies, X-Forwarded-For should be equal to CF-Connecting-IP , can Vercel be touching such headers?

Or can it be a choice to log any specified headers to leadcloud?

[lizheming]

I'm not very sure about those question, maybe you can help us to check it?

[karuboniru]

Yes, I can. But what to do?

[lizheming]

I'll check it in my local and add some header logs later.

[karuboniru]

I self-hosted a waline instance, and ip recording works now(when proxied by Cloudflare), so the problem seems to be a Vercel problem. LOL