starred/vaultwarden

Fork 0

mirror of https://github.com/dani-garcia/vaultwarden.git synced 2026-04-25 17:25:57 +03:00

[GH-ISSUE #303] ignoring X-Forwarded-For headers? #163

New issue

Closed

opened 2026-03-03 01:26:12 +03:00 by kerem · 5 comments

kerem commented

2026-03-03 01:26:12 +03:00

Owner

Originally created by @tycho on GitHub (Dec 17, 2018).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/303

I notice that when using a reverse proxy, bitwarden_rs logs the wrong IP address:

[2018-12-17][09:47:45][bitwarden_rs::api::identity][ERROR] Username or password is incorrect. Try again. IP: 127.0.0.1. Username: ...

This is especially sloppy looking since that error message gets surfaced to the user on the web vault.

My reverse proxy is setting the X-Forwarded-For header, but it seems that bitwarden_rs doesn't pay attention to that when determining the client IP?

Originally created by @tycho on GitHub (Dec 17, 2018). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/303 I notice that when using a reverse proxy, bitwarden_rs logs the wrong IP address: `[2018-12-17][09:47:45][bitwarden_rs::api::identity][ERROR] Username or password is incorrect. Try again. IP: 127.0.0.1. Username: ...` This is especially sloppy looking since that error message gets surfaced to the user on the web vault. My reverse proxy is setting the `X-Forwarded-For` header, but it seems that bitwarden_rs doesn't pay attention to that when determining the client IP?

kerem closed this issue

2026-03-03 01:26:13 +03:00

kerem commented

2026-03-03 01:26:13 +03:00

Author

Owner

@dani-garcia commented on GitHub (Dec 17, 2018):

Rocket uses X-Real-IP for retrieving the clients IP address, instead of X-Forwarded-For.

The error message comes from a time where we didn't have any decent logging in place, but it could be changed now to hide that info from the user.

@dani-garcia commented on GitHub (Dec 17, 2018): Rocket uses `X-Real-IP` for retrieving the clients IP address, instead of `X-Forwarded-For`. The error message comes from a time where we didn't have any decent logging in place, but it could be changed now to hide that info from the user.

kerem commented

2026-03-03 01:26:14 +03:00

Author

Owner

@tycho commented on GitHub (Dec 17, 2018):

Yep, I switched to X-Real-IP and that works! Thanks!

@tycho commented on GitHub (Dec 17, 2018): Yep, I switched to `X-Real-IP` and that works! Thanks!

kerem commented

2026-03-03 01:26:14 +03:00

Author

Owner

@tycho commented on GitHub (Dec 17, 2018):

Oh, maybe the PROXY.md should make mention of the X-Real-IP thing. Here's what I did for nginx:

proxy_set_header X-Real-IP $proxy_add_x_forwarded_for;

@tycho commented on GitHub (Dec 17, 2018): Oh, maybe the `PROXY.md` should make mention of the `X-Real-IP` thing. Here's what I did for nginx: ``` proxy_set_header X-Real-IP $proxy_add_x_forwarded_for; ```

kerem commented

2026-03-03 01:26:14 +03:00

Author

Owner

@dani-garcia commented on GitHub (Dec 17, 2018):

True, I use Caddy which does this by default, so I didn't know. What do you think of adding these (to be equivalent with what Caddy sends)?

proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

@dani-garcia commented on GitHub (Dec 17, 2018): True, I use Caddy which does this by default, so I didn't know. What do you think of adding these (to be equivalent with what Caddy sends)? ``` proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; ```

kerem commented

2026-03-03 01:26:14 +03:00

Author

Owner

@tycho commented on GitHub (Dec 17, 2018):

Seems reasonable to me!

@tycho commented on GitHub (Dec 17, 2018): Seems reasonable to me!

kerem referenced this issue

2026-03-03 02:20:12 +03:00

[PR #170] [MERGED] Fix editing users in Organization #2649