jerryshao opened a new issue, #14021: URL: https://github.com/apache/gravitino/issues/14021
### Version main branch ### Describe what's wrong `RequestContextFilter`, the `HttpAuditFilter` fallback, and `IcebergRequestContext` use the first `X-Forwarded-For` entry as the client address of audit events whenever the header is present. The header is not checked against the proxy the request actually came from, so the recorded address is only reliable when every request goes through a reverse proxy that overwrites the header. This applies to the Gravitino server, the Iceberg REST service, and the Lance REST service. ### Error message and/or stacktrace N/A ### How to reproduce Send a request that carries an `X-Forwarded-For` header directly to the server, without a reverse proxy, and compare the `remoteAddress` in the audit entry with the peer address of the connection. ### Additional context Proposed change: add a `trustedProxies` web server setting (comma-separated IP literals or CIDR blocks, empty by default). Honor `X-Forwarded-For` only when the TCP peer is a trusted proxy, and then use the right-most entry that is not a trusted proxy. With the default empty list, the header is ignored and the TCP peer address is used. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
