{"action":"opened","issue":{"url":"https://api.github.com/repos/engintron/engintron/issues/248","repository_url":"https://api.github.com/repos/engintron/engintron","labels_url":"https://api.github.com/repos/engintron/engintron/issues/248/labels{/name}","comments_url":"https://api.github.com/repos/engintron/engintron/issues/248/comments","events_url":"https://api.github.com/repos/engintron/engintron/issues/248/events","html_url":"https://github.com/engintron/engintron/issues/248","id":173614741,"number":248,"title":"Unsecure CF-Connecting-IP","user":{"login":"voron","id":817268,"avatar_url":"https://avatars.githubusercontent.com/u/817268?v=3","gravatar_id":"","url":"https://api.github.com/users/voron","html_url":"https://github.com/voron","followers_url":"https://api.github.com/users/voron/followers","following_url":"https://api.github.com/users/voron/following{/other_user}","gists_url":"https://api.github.com/users/voron/gists{/gist_id}","starred_url":"https://api.github.com/users/voron/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/voron/subscriptions","organizations_url":"https://api.github.com/users/voron/orgs","repos_url":"https://api.github.com/users/voron/repos","events_url":"https://api.github.com/users/voron/events{/privacy}","received_events_url":"https://api.github.com/users/voron/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-08-27T20:47:09Z","updated_at":"2016-08-27T20:47:09Z","closed_at":null,"body":"It seems You use CF-Connecting-IP header as X-Real-IP without verification request came from CloudFlare IPs. This can be easily exploited. What do You think about checking like following instead of `if ($http_cf_connecting_ip) ` ?\r\n```bash\r\ngeo $cloudflare {\r\n    default 0;\r\n    103.21.244.0/22 1;\r\n    103.22.200.0/22 1;\r\n    #all other IPs from https://www.cloudflare.com/ips-v4 and https://www.cloudflare.com/ips-v6\r\n}\r\nmap $cloudflare $X_REAL_IP {\r\n    1           $http_cf_connecting_ip;\r\n    default     $remote_addr;\r\n}\r\n```\r\n  \r\n"}}
{"actor":{"display_login":"voron"}}