fix: fallback to the tcp connection adress if the ip is not provided in headers

Author: yaroslav8765

adminforth/auth.ts

@@ -6,6 +6,7 @@ import { AdminUserAuthorizationResult, AdminUserAuthorizeFunction, AfterSessionC
 import { AdminUser } from './types/Common.js';
 import { listify, removedInV4 } from './modules/utils.js';
 import { afLogger } from './modules/logger.js';
+import { getRequestContext } from './modules/requestContext.js';
 import { Address4, Address6 } from 'ip-address';
 
 // Returns true for valid IPs which are not globally reachable (private, loopback, link-local, CGNAT, reserved, etc.)
@@ -19,6 +20,11 @@ function isIpPrivate(ip: string | null): boolean {
   return false;
 }
 
+// Node reports IPv4 clients of a dual-stack server as IPv4-mapped IPv6 addresses, e.g. ::ffff:1.2.3.4
+function unmapIpv4(ip: string | null): string | null {
+  return Address6.isValid(ip) && new Address6(ip).is4() ? new Address6(ip).to4().correctForm() : ip;
+}
+
 // Function to generate a password hash using PBKDF2
 function calcPasswordHash(password, salt, iterations = 100000, keyLength = 64, digest = 'sha512') {
   return new Promise((resolve, reject) => {
@@ -85,6 +91,10 @@ class AdminForthAuth implements IAdminForthAuth {
        headersLower['x-host'] ||
        null;
     }
+    if (!ip || isIpPrivate(ip)) {
+      // no proxy header or an internal address in it, so the client is connected directly
+      ip = unmapIpv4(getRequestContext()?.remoteAddress ?? null);
+    }
     if (isIpPrivate(ip)) {
       return null;
     }

adminforth/modules/requestContext.ts

@@ -4,6 +4,7 @@ export const ADMINFORTH_CLIENT_ID_HEADER = 'x-adminforth-client-id';
 
 export type AdminForthRequestContext = {
   websocketClientId?: string;
+  remoteAddress?: string;
 };
 
 const requestContextStorage = new AsyncLocalStorage<AdminForthRequestContext>();

adminforth/servers/express.ts

@@ -300,11 +300,7 @@ class ExpressServer implements IExpressHttpServer {
 
   serve(app) {
     this.expressApp = app;
-    this.expressApp.use((req, res, next) => {
-      runWithRequestContext({
-        websocketClientId: getHeaderString(req.headers, ADMINFORTH_CLIENT_ID_HEADER),
-      }, next);
-    });
+    this.expressApp.use((req, res, next) => this.runInRequestContext(req, next));
     this.patchSchemaAwareRouteRegistration();
     this.flushPendingEndpointRegistrations();
     // Express 5 exposes the router as `app.router`; Express 4 used the internal `app._router`.
@@ -342,6 +338,7 @@ class ExpressServer implements IExpressHttpServer {
   runInRequestContext(req, callback) {
     return runWithRequestContext({
       websocketClientId: getHeaderString(req.headers, ADMINFORTH_CLIENT_ID_HEADER),
+      remoteAddress: req.socket.remoteAddress,
     }, callback);
   }
 

documentation/docs/tutorial/03-Customization/12-security.md

@@ -166,6 +166,7 @@ This function is used for:
 - Can be used by your own code e.g. hooks to write first login/last login IP address to db
 
 By default it takes the last IP address from `X-Forwarded-For` header. Proxies append the address of their client to the end of this header and keep everything the client sent before it, so the last address is the one added by your nearest proxy.
+If there is no such header or it has a private address, AdminForth uses the address of the TCP connection, which is the client itself when there is no proxy in front of the app.
 AdminForth does not understand whether this header can be trusted or no. If there is no proxy in front of the app, the whole header comes from the client and might be spoofed like this:
 
 ```