########################################################################################## JILS-37: Add "Authorised Proxies" to authentication model ########################################################################################## Issue Type: New Feature ----------------------------------------------------------------------------------------- Issue Information ==================== Priority: Major Status: Closed Resolution: Done (2016-04-29 15:05:17) Project: Jira Issue Listing Script (JILS) Reported By: btasker Assigned To: btasker Affected Versions: - 0.01b Targeted for fix in version: - 0.01b Labels: Security, Time Estimate: 77 minutes Time Logged: 43 minutes ----------------------------------------------------------------------------------------- Issue Description ================== The current authentication model works OK when communicating directly with JILS. However, if the JILS server is behind a reverse proxy, it's not currently possible to identify whether the originating IP is authorised or not. Most reverse proxies will set an _X-Forwarded-For_ header, however we cannot simply rely on that as a malicious client could simply send a request with a known authorised IP in that header. So, we need an extra configuration parameter to list known authorised reverse proxies. If the connection has come from one of those IP's the source IP should be extracted from _X-Forwarded-For_ and authentication performed based on that. This makes a couple of assumptions which *must* be true in order for the planned model to work - Downstream Proxy will _always_ set _X-Forwarded-For_ - Downstream Proxy will pass through the client's User-Agent If either of those is untrue then the planned model won't work (or will give unexpected results). They don't seem like unreasonable constraints though. ----------------------------------------------------------------------------------------- Activity ========== ----------------------------------------------------------------------------------------- 2015-11-06 12:34:57 ----------------------------------------------------------------------------------------- btasker changed status from 'Open' to 'In Progress' ----------------------------------------------------------------------------------------- 2015-11-06 12:46:13 btasker ----------------------------------------------------------------------------------------- I've made a change in the codebase which should do what's needed. The only test performed on it so far is a lint test as I need to set up a reverse proxy to test against. Edit: Earlier commit message referenced the wrong issue. Tit. -- BEGIN QUOTE -- Repo: Jira-Issue-Listing Commit: a923157a198e2a79dcfdefe8d5ee4b81fbcb8fe3 Author: Ben Tasker