XFF header processing (#28)

Rafael Blazquez opened 4 weeks ago

Dear Tigase support team

We have a great interest in placing Tigase behind an application LB. We face the problem that the IP reaching Tigase is not the one of the client, and we also have great interest in knowing the IP of the client so we can implement some security ideas.

Based on this, I have a few questions:

Is there any available way for Tigase to work with the XFF header on the WebSocket handshake?
Is it possible for us to customize some class (e.g. WebSocketXMPPIOService) so it can process the XFF header and make it available in the session context for other components later?

Please note that we are in the process of migration to 8.1.0, but we are currently in the latest 7.X version ... so we would like answers for both versions in case there are differences in this matter.

Best regards,

Rafael.

Activities

Wojciech Kapcia (Tigase) changed fields 3 weeks ago
Name Previous Value Current Value
Assignee

wojtek

andrzej.wojcik
Andrzej Wójcik (Tigase) commented 3 weeks ago

There is no easy way to add support for setting (overriding) remote IP address for IOService (base of XMPPIOServer and WebSocketXMPPIOService.

In theory you could modify WebSocketXMPPIOService to return different IP as a result of getRemoteAddress() method after WebSocket headers are processed. You could also get header value from headers variable in WebSocketXMPPIOService:: processWebSocketHandshake() method as we parse all HTTP headers.

Also WebSocketClientConnectionManager:: getXMPPIOServiceInstance() method returns instance of WebSocketXMPPIOService so it would be possible to override it and return a custom class extending WebSocketXMPPIOService.
Rafael Blazquez commented 3 weeks ago

Hi Andrzej

Nice to see you around.

Thats aligned with our own thoughts.

Grabbing the value of the header on the handshake and making available to the rest of rhe server through "getRemoteAddress".

We have still a doubt on how to make those overriden classes available at the classpath. Should we fork the Tigase repository or is there any more covinient way to inject those classes in the classpath?

Best regards,

Rafael
Login to comment

Name	Previous Value	Current Value
Assignee	wojtek	andrzej.wojcik

Type	Question
Priority	Major
Assignee	Andrzej Wójcik (Tigase)
Version	7.X , 8.1.0
Sprints	n/a
Customer	n/a

Issue Votes (0)

Watchers (4)

Reference

tigase/_server/tigase-server#28