Skip to content

🐛 [Bug]: Unix Domain Socket isn't trusted as Localhost #4086

@BhaskarPanja93

Description

@BhaskarPanja93

Bug Description

TLDR: Fiber should trust "Localhost" if nginx or other proxy connects via unix socket..

I have a nginx/1.29.4 serving my fiber backend via unix socket (same device hosting nginx as well as fiber)

NGINX block (minimal):

location ^~ /project/api {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        ....
        proxy_pass http://unix:/PROJECT/back.sock;
    }

Old FIBER config (minimal):

MainApp := fiber.New(fiber.Config{
		AppName:          "Project",
		ProxyHeader:      fiber.HeaderXForwardedFor,
		TrustProxyConfig: fiber.TrustProxyConfig{Loopback: true},
	})

Upto version v3.0.0-rc.3, this setup worked fine and showed the visitor's real IP address when called the ctx.IP()
After version v3 dropped, ctx.IP() no longer gives the real IP and instead returns "0.0.0.0" and IsProxyTrusted() returns false. I changed the config block still no luck:

New FIBER config (minimal):

MainApp := fiber.New(fiber.Config{
		AppName:          "Project",
		ProxyHeader:      fiber.HeaderXForwardedFor,
		TrustProxy:          true,
		TrustProxyConfig: fiber.TrustProxyConfig{Loopback: true},
	})

the only way i can make things work is allow "0.0.0.0" as a trusted proxy but that creates security risk
TrustProxyConfig: fiber.TrustProxyConfig{Proxies: []string{"0.0.0.0"}}

How to Reproduce

Steps to reproduce the behavior:
Fiber should be behind nginx

MainApp := fiber.New(fiber.Config{
		AppName:          "Project",
		ProxyHeader:      fiber.HeaderXForwardedFor,
		TrustProxy:          true,
		TrustProxyConfig: fiber.TrustProxyConfig{Loopback: true},
	})

MainApp.Get("/ip", func(ctx fiber.Ctx) error {
		return ctx.SendString(ctx.IP())
	})

MainApp.Listen(unixSocket, fiber.ListenConfig{
		ListenerNetwork:    fiber.NetworkUnix,
		UnixSocketFileMode: 0760,
	})

Expected Behavior

ctx.IsProxyTrusted() should return true
visiting /ip should give real IP address of the visitor and not "0.0.0.0"

Fiber Version

v3.0.0

Code Snippet (optional)

Checklist:

  • I agree to follow Fiber's Code of Conduct.
  • I have checked for existing issues that describe my problem prior to opening this one.
  • I understand that improperly formatted bug reports may be closed without explanation.

Metadata

Metadata

Assignees

Type

No type

Projects

Status

Done

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions