1.3 KiB
IP restriction utilities
backend/common/ip_restrictions.py provides get_client_ip, is_local_ip,
is_ip_allowed, local_ip_required and local_ip_required_api.
Important: these decorators are not currently attached to the registration views
and there is no registration restriction middleware in MIDDLEWARE. The presence
of REGISTRATION_ALLOWED_IPS in settings therefore does not by itself restrict
registration.
The default setting contains loopback and private network ranges plus the
project's configured corporate range. An empty list denies all addresses and
["*"] permits all.
get_client_ip trusts the first X-Forwarded-For value. This is safe only when
the application is reachable exclusively through a trusted reverse proxy that
overwrites incoming forwarding headers. Otherwise clients can spoof the value.
Before enabling IP enforcement:
- attach the API decorator or implement reviewed middleware for the exact route;
- configure trusted proxy behavior;
- move environment-specific networks out of source defaults;
- test IPv4, IPv6, direct access and forwarded requests;
- retain rate limiting and normal authentication—an IP allowlist is only an additional control.
Tests should target common.ip_restrictions and the decorated registration view,
not only the helper in isolation.