Thanks to visit codestin.com
Credit goes to github.com

Skip to content

get a SecureIp with bazinga geocoder #129

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
blade503 opened this issue Jun 27, 2017 · 5 comments · Fixed by #150
Closed

get a SecureIp with bazinga geocoder #129

blade503 opened this issue Jun 27, 2017 · 5 comments · Fixed by #150
Milestone

Comments

@blade503
Copy link

blade503 commented Jun 27, 2017

I'm using the bazinga geocoder 4.1.0 in a Symfony (3.2.9) project. I use several geolocation part on my application, so I cant use the local ip (127.0.0.1 or docker IP). I need a fakeIp to work with those geolocation. Moreover I use a proxy in local to get an https connection.

The problem is that when I re-write the ip with my fakeip, symfony consider she can't be trust so I get an error because the re-write don't come from my local trusted proxy. Then when I add the IP in the trustedProxies to tell symfony it's a good ip and that he can trust her, but the fakeIp is no more recognize as my local IP.

And symfony starts to use my docker IP. I did few researchs on the internet i thought this could be a solution but it only work partially (https://symfony.com/blog/fixing-the-trusted-proxies-configuration-for-symfony-3-3). I tried to add the trusted proxy of the FakeIP on the FakeRequestListener. But i don't get the result i'm looking for

Sorry for my english. And i hope you can understand my prb

Here is where I am at the moment, it works but i'm forced to add the fakeip in the trusted proxies, thing that i don't want to do, so how could I avoid that ? I just want to reproduce the behaviour of the app on prod, but in local =)

public function onKernelRequest(GetResponseEvent $event)
{
    if (HttpKernelInterface::MASTER_REQUEST !== $event->getRequestType()) {
        return;
    }

    if (null !== $this->fakeIp && !empty($this->fakeIp)) {
           $event->getRequest()->server->set('REMOTE_ADDR', $this->fakeIp);
            $event->getRequest()->setTrustedProxies(array($this->fakeIp));
            $res = $event->getRequest()->getTrustedHeaderName(Request::HEADER_CLIENT_IP);
            $event->getRequest()->setTrustedHeaderName(Request::HEADER_CLIENT_IP , $this->fakeIp  .','. $res );
        }
}
@Nyholm
Copy link
Member

Nyholm commented Jun 28, 2017

Thank you for this issue. I will look into updating the fakeIP feature for next release

@Nyholm Nyholm added this to the Version 5.0.0 milestone Jun 28, 2017
@blade503
Copy link
Author

Thanks for considering my request, but would you be able to provide me a temporary solution or something that could be able to resolve my prb with isSecure() ?

@Nyholm
Copy link
Member

Nyholm commented Jun 28, 2017

The suggestion you wrote here overwrites the existing TrustedProxies. Also, it could be a security breach if an attacker knows what ip you are using as "fake ip".
I'll try to dig into this. I have no solution on the top of my head.

@blade503
Copy link
Author

blade503 commented Jun 28, 2017

yes that's why i don't want to use the solution i wrote (i gave it as a possible hint of thinking for peoples), it's too risky to use as it is. I'm using an ip defined in config_dev.yml ( for example 130.211.3.176 )

@Nyholm
Copy link
Member

Nyholm commented Jul 15, 2017

I got an idea. We have to use a plugin that rewrites the queries if 127.0.0.1 is in them.
This will not mess up anything with Symfony.

We have to wait for geocoder-php/Geocoder#742 to be merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants