Correctly use X-Forwarded-* headers

torchbox · May 14, 2024 · 61c52bd · 61c52bd
1 parent 7b1e044
commit 61c52bd
Show file tree

Hide file tree

Showing 3 changed files with 25 additions and 1 deletion.
diff --git a/calmerge/__init__.py b/calmerge/__init__.py
@@ -1,6 +1,8 @@
+import os
 from pathlib import Path
 
 import aiohttp_jinja2
+import aiohttp_remotes
 from aiohttp import web
 from jinja2 import FileSystemLoader
 
@@ -22,6 +24,12 @@ def get_aiohttp_app(config: Config) -> web.Application:
         ],
     )
 
+    app.middlewares.append(
+        aiohttp_remotes.XForwardedRelaxed(
+            num=int(os.environ.get("X_FORWARDED_NUM", 1))
+        ).middleware
+    )
+
     jinja2_env.filters["calendar_url"] = templates.calendar_url
 
     app["config"] = config

diff --git a/poetry.lock b/poetry.lock
diff --git a/pyproject.toml b/pyproject.toml
@@ -14,6 +14,7 @@ icalendar = "^5.0.11"
 aiocache = "^0.12.2"
 aiohttp-jinja2 = "^1.6"
 
+aiohttp-remotes = "^1.2.0"
 [tool.poetry.group.dev.dependencies]
 ruff = "^0.3.2"
 pytest = "^8.1.1"