Glimpse/Glimpse — Issue #153: IpAddressValidator .GetUserIpAddress crashes with IpForwardingEnabled=true
Author: willdean
Created: 2012-01-05 08:39:56+00:00
State: open

Our hosting provider runs IIS boxes behind a load balancer. The balancer inserts an HTTP_X_FORWARDED_FOR header which looks like this:

comma space

When we set IpFowardingEnabled to true, any attempt to go to glimpse.axd causes an exception in the IPAddress.Parse in GetUserIpAddress in IpAddressValidator. The exception is due to the space which proceeds the second IP address following the Split() operation.

There are two bugs here, I think:

* The code should be using First(), not Last(), because the convention with X_FORWARDED_FOR is that the client is the first IP address.

* It would be more robust to add a 'Trim()', even though it wouldn't actually be needed in my case if First() was used.

So my proposed replacement for line 72 in GetUserIpAddress is:

return IPAddress.Parse(forwardedFor.Split(',').First().Trim());

Clearly this would be a breaking change for anyone whose forwarder was actually putting the client IP at the end of the list not the beginning - if there are such people, then this is going to need a rethink or another option, perhaps.