Allow use of X-Forwarded-For [$5 awarded] #107

New Issue

2026-10-05T03:59:13+02:00

adam commented

2026-10-05 03:59:13 +02:00

Adding the X-Forwarded-For header would allow any instance of ZNC behind a reverse-proxy to set proper IPs for a cookie, and show the proper IP in webadmin.

Also, an allowed-proxies config variable should be added, as a white-list to prevent abuse.

The $5 bounty on this issue has been claimed at Bountysource.

Adding the X-Forwarded-For header would allow any instance of ZNC behind a reverse-proxy to set proper IPs for a cookie, and show the proper IP in webadmin. Also, an `allowed-proxies` config variable should be added, as a white-list to prevent abuse. ## <bountysource-plugin> --- The **[$5 bounty](https://www.bountysource.com/issues/663-allow-use-of-x-forwarded-for?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** on this issue has been claimed at [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github). </bountysource-plugin>

adam closed this issue

2026-10-05 03:59:13 +02:00

adam commented

2026-10-05 03:59:14 +02:00

What bug with session cookies?

What bug with session cookies?

adam commented

2026-10-05 03:59:15 +02:00

Whenever more than five or so users use webadmin at once, I tend to get "Invaild Session for your IP" errors.

Whenever more than five or so users use webadmin at once, I tend to get "Invaild Session for your IP" errors.

adam commented

2026-10-05 03:59:15 +02:00

It's not related to number of users... Each session stores your IP, from which you created that session.
If you try to use another IP with existing session, you get that error. Do you change your IP? Maybe you change your proxies?
You can turn that protection off in global settings of webadmin, but that would decrease security.

It's not related to number of users... Each session stores your IP, from which you created that session. If you try to use another IP with existing session, you get that error. Do you change your IP? Maybe you change your proxies? You can turn that protection off in global settings of webadmin, but that would decrease security.

adam commented

2026-10-05 03:59:16 +02:00

I see, that's odd.

I see, that's odd.

adam commented

2026-10-05 03:59:17 +02:00

I think what @neersighted is saying, is that he is putting his ZNC behind a reverse proxy. So all the clients are coming from the IP of the proxy. Proxies usually set X-Forwarded headers indicating the real IP/protocol etc.

This sounds like a feature request for an option to follow these headers.

x-forwarded-proto: https
x-forwarded-port: 443
x-forwarded-for: 172.16.0.241

I think what @neersighted is saying, is that he is putting his ZNC behind a reverse proxy. So all the clients are coming from the IP of the proxy. Proxies usually set X-Forwarded headers indicating the real IP/protocol etc. This sounds like a feature request for an option to follow these headers. ``` x-forwarded-proto: https x-forwarded-port: 443 x-forwarded-for: 172.16.0.241 ```

adam commented

2026-10-05 03:59:17 +02:00

Yes, that's what I meant.

Yes, that's what I meant.

adam commented

2026-10-05 03:59:18 +02:00

bump.

bump.

adam commented

2026-10-05 03:59:19 +02:00

bump +1 for this proxying stuff like this down with apache is common stuff and should work

bump +1 for this proxying stuff like this down with apache is common stuff and should work

adam commented

2026-10-05 03:59:19 +02:00

Also, nginx usually uses X-Real-IP, or X-Forwarded-For, so both should be supported.

Also, nginx usually uses `X-Real-IP`, or `X-Forwarded-For`, so both should be supported.

adam commented

2026-10-05 03:59:20 +02:00

The latest nginx configs you cen get from the wiki contain both headers in the include file that's used.

The latest nginx configs you cen get from the wiki contain both headers in the include file that's used.

adam commented

2026-10-05 03:59:21 +02:00

I have tried this patch https://github.com/MartinMartimeo/znc/commit/44be37a33e0df7df00cd09b2a1d9ff15c0599780 on the latest znc git version (at the time of this writing) and it works perfectly.

I have tried this patch https://github.com/MartinMartimeo/znc/commit/44be37a33e0df7df00cd09b2a1d9ff15c0599780 on the latest znc git version (at the time of this writing) and it works perfectly.

adam commented

2026-10-05 03:59:21 +02:00