From f00550263a1c657b6ed7dbc5b6a0c16870251618 Mon Sep 17 00:00:00 2001
From: Guus der Kinderen <guus.der.kinderen@gmail.com>
Date: Fri, 25 Sep 2026 12:25:39 +0200
Subject: [PATCH] fixes #249: Do not trust client-provided forwarded headers
 for the IP address check

The IP address used to check against the list of allowed IP addresses was taken from the 'X-Forwarded-For' header (and some variants) when present. As any client can set that header, the check could easily be bypassed.

The address is now obtained from the request's remote address only. The REST API is served by the admin console's web server, which (when configured to do so) replaces that address with the value from forwarded headers. Since Openfire 5.1.0 (OF-3261), it can be configured to do so only for requests from trusted proxies. This plugin now requires Openfire 5.1.0 or later.

The admin console page of the REST API shows a warning when the IP address check is enabled, while the admin console uses forwarded headers without a list of trusted proxies.
---
 changelog.html                                |   2 ++
 plugin.xml                                    |   2 +-
 pom.xml                                       |   2 +-
 readme.md                                     |  24 ++++++++++++++
 .../openfire/plugin/rest/AuthFilter.java      |  15 +++------
 .../plugin/rest/RESTServicePlugin.java        |  21 ++++++++++++
 .../rest/service/UserServiceLegacy.java       |  15 +++------
 src/web/images/warning-16x16.gif              | Bin 0 -> 580 bytes
 src/web/rest-api.jsp                          |  30 ++++++++++++++++--
 9 files changed, 84 insertions(+), 27 deletions(-)
 create mode 100644 src/web/images/warning-16x16.gif

diff --git a/changelog.html b/changelog.html
index fad07088da..82d83c4b49 100644
--- a/changelog.html
+++ b/changelog.html
@@ -46,9 +46,11 @@ <h1>
 
 <p><b>1.12.1</b> (to be determined)</p>
 <ul>
+    <li>Now requires Openfire 5.1.0 or later</li>
     <li>[<a href="https://github.com/igniterealtime/openfire-restAPI-plugin/issues/259">#259</a>] - Prevent system property requests from affecting properties other than the one requested</li>
     <li>[<a href="https://github.com/igniterealtime/openfire-restAPI-plugin/issues/256">#256</a>] - Record configuration changes in audit log</li>
     <li>[<a href="https://github.com/igniterealtime/openfire-restAPI-plugin/issues/251">#251</a>] - Enable JUnit 5 tests</li>
+    <li>[<a href="https://github.com/igniterealtime/openfire-restAPI-plugin/issues/249">#249</a>] - Only trust forwarded headers (such as X-Forwarded-For) from trusted reverse proxies</li>
     <li>[<a href="https://github.com/igniterealtime/openfire-restAPI-plugin/issues/248">#248</a>] - Do not expose properties that are encrypted or otherwise sensitive.</li>
     <li>[<a href="https://github.com/igniterealtime/openfire-restAPI-plugin/issues/246">#246</a>] - Require custom authenticator plugin to be annotated as an authenticator</li>
     <li>[<a href="https://github.com/igniterealtime/openfire-restAPI-plugin/issues/244">#244</a>] - Prevent REST API plugin from exposing its own configuration (including authentication) via its own endpoints</li>
diff --git a/plugin.xml b/plugin.xml
index 73a7ca070d..4200247dfa 100644
--- a/plugin.xml
+++ b/plugin.xml
@@ -7,7 +7,7 @@
     <author>Roman Soldatow</author>
     <version>${project.version}</version>
     <date>2026-09-24</date>
-    <minServerVersion>5.0.0</minServerVersion>
+    <minServerVersion>5.1.0</minServerVersion>
     <adminconsole>
         <tab id="tab-server">
             <sidebar id="sidebar-server-settings">
diff --git a/pom.xml b/pom.xml
index e00ea4f168..067c625f40 100644
--- a/pom.xml
+++ b/pom.xml
@@ -4,7 +4,7 @@
     <parent>
         <artifactId>plugins</artifactId>
         <groupId>org.igniterealtime.openfire</groupId>
-        <version>5.0.0</version>
+        <version>5.1.0</version>
     </parent>
     <groupId>org.igniterealtime.openfire.plugins</groupId>
     <artifactId>restAPI</artifactId>
diff --git a/readme.md b/readme.md
index 376f127e5c..111c96c387 100644
--- a/readme.md
+++ b/readme.md
@@ -108,6 +108,30 @@ The third requirement cannot be verified automatically and is the implementer's
 implements the interface and carries the annotation, but returns without calling `abortWith(...)` on an
 unauthenticated request, will be loaded successfully and will silently grant unauthenticated access.
 
+### Restricting access by IP address
+
+Access to the REST API can additionally be limited to a list of allowed IP addresses. This is configured in the
+Openfire Admin console under Server > Server Settings > REST API (backed by the `plugin.restapi.allowedIPs` system
+property). When the list is empty, requests from any IP address are accepted.
+
+The plugin checks the IP address of the peer that is directly connected to Openfire. It does not itself inspect
+headers like `X-Forwarded-For`, as these can be set to arbitrary values by any client. When the REST API is accessed
+through a reverse proxy, configure Openfire's admin console to use the forwarded client address instead: enable
+`adminConsole.forwarded.enabled`, and list the IP addresses (or ranges) of your proxies in
+`adminConsole.forwarded.trusted.proxies`. Both can be set on the Admin Console Access page (Server > Server
+Manager > Admin Console Access). Openfire then uses forwarded headers only on requests that come from one of those
+trusted proxies.
+
+Be aware of the following:
+
+- When `adminConsole.forwarded.enabled` is `true` but no trusted proxies are configured, Openfire uses forwarded
+  headers from _any_ peer. Any client can then bypass the IP address check by sending a forged header. The REST API
+  shows a warning on its admin console page when it detects this configuration.
+- Make sure that your reverse proxy _replaces_ any `Forwarded` or `X-Forwarded-For` header that it receives from the
+  client, instead of appending to it. Otherwise, a value provided by the client can still end up being used as the
+  client's address.
+- Changes to the `adminConsole.forwarded.*` properties take effect only after the admin console has been restarted.
+
 # User related REST Endpoints
 
 ## Retrieve users
diff --git a/src/java/org/jivesoftware/openfire/plugin/rest/AuthFilter.java b/src/java/org/jivesoftware/openfire/plugin/rest/AuthFilter.java
index 561475930d..7a5b1ef809 100644
--- a/src/java/org/jivesoftware/openfire/plugin/rest/AuthFilter.java
+++ b/src/java/org/jivesoftware/openfire/plugin/rest/AuthFilter.java
@@ -84,17 +84,10 @@ public void filter(ContainerRequestContext containerRequest) throws IOException
         }
 
         if (!RESTServicePlugin.ALLOWED_IPS.getValue().isEmpty()) {
-            // Get client's IP address
-            String ipAddress = httpRequest.getHeader("x-forwarded-for");
-            if (ipAddress == null) {
-                ipAddress = httpRequest.getHeader("X_FORWARDED_FOR");
-                if (ipAddress == null) {
-                    ipAddress = httpRequest.getHeader("X-Forward-For");
-                    if (ipAddress == null) {
-                        ipAddress = httpRequest.getRemoteAddr();
-                    }
-                }
-            }
+            // Get client's IP address. Do not inspect headers like 'X-Forwarded-For' here: these can be spoofed by the client.
+            // When Openfire is configured to be accessed through a reverse proxy, its web server already replaces the remote
+            // address with the value from such headers, but only for requests from proxies that are configured to be trusted.
+            final String ipAddress = httpRequest.getRemoteAddr();
             if (!RESTServicePlugin.ALLOWED_IPS.getValue().contains(ipAddress)) {
                 LOG.warn("REST API rejected service for IP address: " + ipAddress);
                 throw new WebApplicationException(Status.UNAUTHORIZED);
diff --git a/src/java/org/jivesoftware/openfire/plugin/rest/RESTServicePlugin.java b/src/java/org/jivesoftware/openfire/plugin/rest/RESTServicePlugin.java
index b0b0d16c47..90a725330a 100644
--- a/src/java/org/jivesoftware/openfire/plugin/rest/RESTServicePlugin.java
+++ b/src/java/org/jivesoftware/openfire/plugin/rest/RESTServicePlugin.java
@@ -17,6 +17,7 @@
 package org.jivesoftware.openfire.plugin.rest;
 
 import org.jivesoftware.admin.AuthCheckFilter;
+import org.jivesoftware.openfire.container.AdminConsolePlugin;
 import org.jivesoftware.openfire.container.Plugin;
 import org.jivesoftware.openfire.container.PluginManager;
 import org.jivesoftware.openfire.plugin.rest.service.JerseyWrapper;
@@ -148,6 +149,26 @@ public void destroyPlugin() {
         AuthCheckFilter.removeExclude(JerseyWrapper.SERVLET_URL);
     }
 
+    /**
+     * Checks if the IP addresses that are verified against {@link #ALLOWED_IPS} can be controlled by the client.
+     *
+     * The REST API is served by the admin console's web server. When that is configured to use 'Forwarded' or
+     * 'X-Forwarded-For' style HTTP headers to determine the address of the client, but no trusted reverse proxies are
+     * configured, then these headers are honored when sent by any peer. In that case, any client can pretend to have
+     * an address that is on the list of allowed IP addresses.
+     *
+     * Note that changes to the admin console configuration only take effect after the admin console is restarted. This
+     * method evaluates the configured values, which may differ from the configuration that is currently in effect.
+     *
+     * @return true if a non-empty list of allowed IP addresses is configured that can be bypassed by spoofing headers.
+     */
+    public static boolean isAllowedIPsCheckSpoofable()
+    {
+        return !ALLOWED_IPS.getValue().isEmpty()
+            && AdminConsolePlugin.ADMIN_CONSOLE_FORWARDED.getValue()
+            && AdminConsolePlugin.ADMIN_CONSOLE_FORWARDED_TRUSTED_PROXIES.getValue().isEmpty();
+    }
+
     /**
      * Validates the custom authentication filter class name.
      *
diff --git a/src/java/org/jivesoftware/openfire/plugin/rest/service/UserServiceLegacy.java b/src/java/org/jivesoftware/openfire/plugin/rest/service/UserServiceLegacy.java
index 4ce5db4e5c..157c78a99e 100644
--- a/src/java/org/jivesoftware/openfire/plugin/rest/service/UserServiceLegacy.java
+++ b/src/java/org/jivesoftware/openfire/plugin/rest/service/UserServiceLegacy.java
@@ -74,17 +74,10 @@ public Response userSerivceRequest() throws IOException {
         PrintWriter out = response.getWriter();
 
         if (!RESTServicePlugin.ALLOWED_IPS.getValue().isEmpty()) {
-            // Get client's IP address
-            String ipAddress = request.getHeader("x-forwarded-for");
-            if (ipAddress == null) {
-                ipAddress = request.getHeader("X_FORWARDED_FOR");
-                if (ipAddress == null) {
-                    ipAddress = request.getHeader("X-Forward-For");
-                    if (ipAddress == null) {
-                        ipAddress = request.getRemoteAddr();
-                    }
-                }
-            }
+            // Get client's IP address. Do not inspect headers like 'X-Forwarded-For' here: these can be spoofed by the client.
+            // When Openfire is configured to be accessed through a reverse proxy, its web server already replaces the remote
+            // address with the value from such headers, but only for requests from proxies that are configured to be trusted.
+            final String ipAddress = request.getRemoteAddr();
             if (!RESTServicePlugin.ALLOWED_IPS.getValue().contains(ipAddress)) {
                 LOG.warn("User service rejected service to IP address: " + ipAddress);
                 replyError("RequestNotAuthorised", response, out);
diff --git a/src/web/images/warning-16x16.gif b/src/web/images/warning-16x16.gif
new file mode 100644
index 0000000000000000000000000000000000000000..15ba374c5e9d0a9ed3e1a657c00c5cc5726c7648
GIT binary patch
literal 580
zcmV-K0=xZ3Nk%w1VGsZi0OoxF`Skz-1`+x60KAqG@ZO2>&qWXvEA8G@!I>+zlMV3W
zl)#xN$Du{`>p;h$K-8=|{`>&Hm>KoxLG$OO-nB^b;gZv?SMT44!<|3awo38ggt(m&
z^xvxJ)1=O(H2(ef^60qh&4m5>^V6^~{_-aO`yGym8ornn@#1VgIwb7ed-CNg_U<9i
zsz<bp820W4CMP)P(}LpAspr&p-M@Ott$pm<Vf5of<Hv8^!)dmTDF5h3<;f%c<1+W|
z*xk*byq6IC_T{;h4!V^S?AmPa-&ObQ7VO(@?AvMc=@<ItXYk-q?c7?um=N&d!}jU1
z@7}og_bR)T8_T6b)v!JP{|Ws0^y}G&?Amtr<XH0MqS3A(KsO$|o;S~}C*i(cI6Ot&
z+(!8D-}v$i?c09Bn>BKDK>G0+H8wx@>dEfp0NTa^_U4`T(m4PB0T2=){PhU_{{Z*v
zrt9W1@#9w7&LGRCKk?y|*sVgpm>~T70OQoU|Nj90|Nj6000000A^8LW004aeEC2ui
z01yBW000M}fPI34goTEEJ}pyFhlLa%Pj(`Wf*d$n6*DxH9}jFJUP>NfjUh1w0R}up
z7KcGp3T<yNbrM@nhF@1IJ1J--D=b}wX&DzpSte#ANn>k2gm`yYHcNA1MlS$-QdWW;
zIRr;cHwhbX0uX#^HG&QkWJm`+TwqmtaeRD2f(&vRDCjge6UB`_eJ%vaz)%Lkf;<sU
SGyyVTh>ks!GHM(Y2mm`&9w}k~

literal 0
HcmV?d00001

diff --git a/src/web/rest-api.jsp b/src/web/rest-api.jsp
index ed660fe733..9f0d090952 100644
--- a/src/web/rest-api.jsp
+++ b/src/web/rest-api.jsp
@@ -112,9 +112,6 @@
 </head>
 <body>
 
-    <p>Use the form below to enable or disable the REST API and
-        configure the authentication.</p>
-
     <%
         if (success) {
     %>
@@ -136,6 +133,29 @@
         }
     %>
     
+    <%
+        if (RESTServicePlugin.isAllowedIPsCheckSpoofable()) {
+    %>
+    <div class="jive-warning">
+        <table cellpadding="0" cellspacing="0" border="0">
+            <tbody>
+            <tr>
+                <td class="jive-icon"><img src="images/warning-16x16.gif"
+                                           width="16" height="16" border="0"></td>
+                <td class="jive-icon-label">Access is restricted to specific IP addresses, but the admin console is
+                    configured to determine the client address from forwarded HTTP headers (such as X-Forwarded-For),
+                    without a list of trusted proxies. Any client can bypass the IP address check by sending such a header.
+                    Configure the addresses of your reverse proxies as trusted proxies on the
+                    <a href="../../system-admin-console-access.jsp">Admin Console Access</a> page.
+                </td>
+            </tr>
+            </tbody>
+        </table>
+    </div>
+    <br>
+    <%
+        }
+    %>
     <%  
         if (errors.get("loadingStatus") != null) { 
     %>
@@ -175,6 +195,9 @@
         }
     %>
 
+    <p>Use the form below to enable or disable the REST API and
+        configure the authentication.</p>
+
     <form action="rest-api.jsp?save" method="post">
 
         <fieldset>
@@ -230,6 +253,7 @@
 
                     <label for="allowedIPs">Allowed IP Addresses:</label>
                     <textarea name="allowedIPs" cols="40" rows="3" wrap="virtual"><%=((allowedIPs != null) ? allowedIPs : "")%></textarea>
+                    <div style="margin-left: 20px; margin-top: 5px;">Note: when the REST API is accessed through a reverse proxy, configure Openfire to use the forwarded client address, and to trust only your proxies, on the <a href="../../system-admin-console-access.jsp">Admin Console Access</a> page.</div>
                     <br>
                     <br>