CAS-6139/ip headers

README.md

@@ -36,15 +36,19 @@ const castle = Castle({ apiSecret: 'YOUR SECRET HERE' });
 
 #### Config options
 
-| Config option     | Explanation                                                                                                                                                                             |
-| ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| apiSecret         | `string` - This can be found in the castle dashboard.                                                                                                                                   |
-| timeout           | `number` - Time before returning the failover strategy. Default value is 500.                                                                                                           |
-| allowlisted    | `string[]` - An array of strings matching the headers you want to pass fully to the service.                                                                                            |
-| denylisted | `string[]` - An array of of strings matching the headers you do not want to pass fully to the service.                                                                                  |
+| Config option     | Explanation |
+| ----------------- | ----------- |
+| apiSecret         | `string` - This can be found in the castle dashboard. |
+| timeout           | `number` - Time before returning the failover strategy. Default value is 500. |
+| allowlisted       | `string[]` - An array of strings matching the headers you want to pass fully to the service. |
+| denylisted        | `string[]` - An array of of strings matching the headers you do not want to pass fully to the service. |
 | failoverStrategy  | `string` - If the request to our service would for some reason time out, this is where you select the automatic response from `authenticate`. Options are `allow`, `deny`, `challenge`. |
-| logLevel          | `string` - Corresponds to standard log levels: `trace`, `debug`, `info`, `warn`, `error`, `fatal`. Useful levels are `info` and `error`.                                                |
-| doNotTrack        | `boolean` - False by default, setting it to true turns off all requests and triggers automatic failover on `authenticate`. Used for development and testing.                            |
+| logLevel          | `string` - Corresponds to standard log levels: `trace`, `debug`, `info`, `warn`, `error`, `fatal`. Useful levels are `info` and `error`. |
+| doNotTrack        | `boolean` - False by default, setting it to true turns off all requests and triggers automatic failover on `authenticate`. Used for development and testing. |
+| ipHeaders         | `string[]` - IP Headers to look for a client IP address. |
+| trustedProxies    | `string[]` - Trusted public proxies list. |
+| trustProxyChain   | `boolean` - False by default, defines if trusting all of the proxy IPs in X-Forwarded-For is enabled. |
+| trustedProxyDepth | `number` - Number of trusted proxies used in the chain. |
 
 ## Actions
 

src/Castle.ts

@@ -2,7 +2,11 @@ import fetch from 'node-fetch';
 import AbortController from 'abort-controller';
 import pino from 'pino';
 
-import { DEFAULT_ALLOWLIST } from './constants';
+import {
+  DEFAULT_ALLOWLIST,
+  DEFAULT_API_URL,
+  DEFAULT_TIMEOUT,
+} from './constants';
 import { AuthenticateResult, Configuration, Payload } from './models';
 import {
   CommandAuthenticateService,
@@ -14,9 +18,6 @@ import {
 } from './failover/failover.module';
 import { LoggerService } from './logger/logger.module';
 
-const DEFAULT_API_URL = 'https://api.castle.io/v1';
-const DEFAULT_TIMEOUT = 1000;
-
 // The body on the request is a stream and can only be
 // read once, by default. This is a workaround so that the
 // logging functions can read the body independently
@@ -51,6 +52,10 @@ export class Castle {
     failoverStrategy = FailoverStrategy.allow,
     logLevel = 'error',
     doNotTrack = false,
+    ipHeaders = [],
+    trustedProxies = [],
+    trustProxyChain = false,
+    trustedProxyDepth = 0,
   }: Configuration) {
     if (!apiSecret) {
       throw new Error(
@@ -70,6 +75,12 @@ export class Castle {
       failoverStrategy,
       logLevel,
       doNotTrack,
+      ipHeaders,
+      trustedProxies: trustedProxies.length
+        ? trustedProxies.map((proxy) => new RegExp(proxy))
+        : [],
+      trustProxyChain,
+      trustedProxyDepth,
     };
     this.logger = pino({
       prettyPrint: {

src/constants/default-allowlist.ts → src/constants/configuration.ts

@@ -1,3 +1,5 @@
+export const DEFAULT_API_URL = 'https://api.castle.io/v1';
+export const DEFAULT_TIMEOUT = 1000;
 export const DEFAULT_ALLOWLIST = [
   'accept',
   'accept-charset',
@@ -23,3 +25,17 @@ export const DEFAULT_ALLOWLIST = [
   'x-castle-client-id',
   'x-requested-with',
 ];
+export const TRUSTED_PROXIES = [
+  new RegExp(
+    [
+      /^127\.0\.0\.1$|/,
+      /^(10|172\.(1[6-9]|2[0-9]|30|31)|192\.168)\.|/,
+      /^::1\Z|\Afd[0-9a-f]{2}:.+|/,
+      /^localhost$|/,
+      /^unix$|/,
+      /^unix:/,
+    ]
+      .map((r) => r.source)
+      .join('')
+  ),
+];

src/constants/index.ts

@@ -1 +1 @@
-export * from './default-allowlist';
+export * from './configuration';

src/context/services/context-get-default.service.ts

@@ -1,12 +1,14 @@
 import { Configuration } from '../../models';
 import { HeadersExtractService } from '../../headers/headers.module';
+import { IPsExtractService } from '../../ips/ips.module';
 import { version } from '../../../package.json';
 
 export const ContextGetDefaultService = {
   call: (context: any, configuration: Configuration) => {
     return {
       client_id: context.client_id || false,
       headers: HeadersExtractService.call(context.headers, configuration),
+      ip: IPsExtractService.call(context.headers, configuration),
       library: {
         name: 'castle-node',
         version,

src/headers/services/headers-extract.service.ts

@@ -8,7 +8,7 @@ const ALWAYS_DENYLISTED = ['cookie', 'authorization'];
 export const HeadersExtractService = {
   call: (
     headers: IncomingHttpHeaders,
-    { allowlisted, denylisted }: Configuration
+    { allowlisted = [], denylisted = [] }: Configuration
   ) => {
     return reduce(
       headers,

src/ips/ips.module.ts

@@ -0,0 +1 @@
+export * from './services';

src/ips/services/index.ts

@@ -0,0 +1 @@
+export * from './ips-extract.service';

src/ips/services/ips-extract.service.ts

@@ -0,0 +1,67 @@
+import { IncomingHttpHeaders } from 'http';
+import { Configuration } from '../../models';
+import { TRUSTED_PROXIES } from '../../constants';
+
+// ordered list of ip headers for ip extraction
+const DEFAULT = ['x-forwarded-for', 'remote-addr'];
+// list of header which are used with proxy depth setting
+const DEPTH_RELATED = ['x-forwarded-for'];
+
+const checkInternal = (ipAddress: string, proxies: any[]) => {
+  return proxies.some((proxyRegexp) => proxyRegexp.test(ipAddress));
+};
+
+const limitProxyDepth = (ips, ipHeader, trustedProxyDepth) => {
+  if (DEPTH_RELATED.includes(ipHeader)) {
+    ips.splice(ips.length - 1, trustedProxyDepth);
+  }
+  return ips;
+};
+
+const IPsFrom = (ipHeader, headers, trustedProxyDepth) => {
+  if (!headers) {
+    return [];
+  }
+  const headerValue = headers[ipHeader];
+
+  if (!headerValue) {
+    return [];
+  }
+  const ips = headerValue.trim().split(/[,\s]+/);
+  return limitProxyDepth(ips, ipHeader, trustedProxyDepth);
+};
+
+const removeProxies = (ips, trustProxyChain, proxiesList) => {
+  if (trustProxyChain) {
+    return ips[0];
+  }
+  const filteredIps = ips.filter((ip) => !checkInternal(ip, proxiesList));
+  return filteredIps[filteredIps.length - 1];
+};
+
+export const IPsExtractService = {
+  call: (
+    headers: IncomingHttpHeaders,
+    {
+      ipHeaders = [],
+      trustedProxies = [],
+      trustProxyChain = false,
+      trustedProxyDepth = 0,
+    }: Configuration
+  ) => {
+    const ipHeadersList = ipHeaders.length ? ipHeaders : DEFAULT;
+    const proxiesList = trustedProxies.concat(TRUSTED_PROXIES);
+    let allIPs = [];
+    for (const ipHeader of ipHeadersList) {
+      const IPs = IPsFrom(ipHeader, headers, trustedProxyDepth);
+      const IPValue = removeProxies(IPs, trustProxyChain, proxiesList);
+      if (IPValue) {
+        return IPValue;
+      }
+      allIPs = [...allIPs, ...IPs];
+    }
+
+    // fallback to first listed ip
+    return allIPs[0];
+  },
+};

src/models/configuration.ts

@@ -11,4 +11,8 @@ export type Configuration = {
   failoverStrategy?: FailoverStrategy;
   logLevel?: pino.Level;
   doNotTrack?: boolean;
+  ipHeaders?: string[];
+  trustedProxies?: RegExp[];
+  trustProxyChain?: boolean;
+  trustedProxyDepth?: number;
 };

test/Castle.test.ts

@@ -17,6 +17,7 @@ const sampleRequestData = {
     client_id: 'clientid',
     headers: {
       Cookie: 'SECRET=pleasedontbehere',
+      'x-forwarded-for': '8.8.8.8',
     },
   },
 };

test/context/services/context-get-default.service.test.ts

@@ -4,21 +4,29 @@ import { version } from '../../../package.json';
 describe('ContextGetDefaultService', () => {
   describe('call', () => {
     const expected = {
-      headers: {},
+      headers: {
+        'x-forwarded-for': '1.2.3.4',
+      },
       library: {
         name: 'castle-node',
         version,
       },
       client_id: 'client_id',
+      ip: '1.2.3.4',
     };
 
     const config = {
       apiSecret: 'test',
       apiUrl: 'castle.io',
+      denylisted: [],
+      allowlisted: [],
     };
 
     const context = {
       client_id: 'client_id',
+      headers: {
+        'x-forwarded-for': '1.2.3.4',
+      },
     };
 
     it('generates default context', () => {

test/core/services/core-generate-request-body.service.test.ts

@@ -19,7 +19,9 @@ describe('CoreGenerateRequestBody', () => {
       context: {
         ip: '127.0.0.1',
         client_id: 'client_id',
-        headers: {},
+        headers: {
+          'x-forwarded-for': '127.0.0.1',
+        },
         library: {
           name: 'castle-node',
           version,
@@ -37,7 +39,9 @@ describe('CoreGenerateRequestBody', () => {
       context: {
         ip: '127.0.0.1',
         client_id: 'client_id',
-        headers: {},
+        headers: {
+          'x-forwarded-for': '127.0.0.1',
+        },
       },
     };