Skip to content

fix: unbracket a port-less IPv6 address in Forwarded - #153

Open
bosvaldas wants to merge 2 commits into
roadrunner-server:masterfrom
bosvaldas:fix-forwarded-bracketed-ipv6
Open

bosvaldas wants to merge 2 commits into
roadrunner-server:masterfrom
bosvaldas:fix-forwarded-bracketed-ipv6

Conversation

@bosvaldas

@bosvaldas bosvaldas commented Oct 19, 2026 •

Copy link
Copy Markdown

Reason for This PR

RFC 7239 requires an IPv6 node in Forwarded to be bracketed and quoted, also without a port: for="[2001:db8:cafe::17]". parseForwarded trims the quotes but keeps the brackets, so RemoteAddr becomes [2001:db8:cafe::17]. That is neither host:port nor an IP, so the http plugin's FetchIP logs remote address parsing failure ... missing port in address and PHP receives an empty REMOTE_ADDR.

We hit this in production behind a trusted proxy: affected requests reached the application with an empty client IP.

Description of Changes

  • parseForwarded strips the brackets from a bracketed IPv6 node that has no port. [v6]:port is returned unchanged, as before.
  • Unit case in TestIP and an end-to-end case in TestForwarded. Against master the latter fails with expected: "2001:db8:cafe::17", actual: "".

License Acceptance

By submitting this pull request, I confirm that my contribution is made under
the terms of the MIT license.

PR Checklist

  • All commits in this PR are signed (git commit -s).
  • The reason for this PR is clearly provided (issue no. or explanation).
  • The description of changes is clear and encompassing.
  • Any required documentation changes (code and docs) are included in this PR.
  • Any user-facing changes are mentioned in CHANGELOG.md (generated by release-please from the commit title).
  • All added/changed functionality is tested.

Osvaldas Beniušis added 2 commits October 19, 2026 17:18
Signed-off-by: Osvaldas Beniušis <osvaldas.beniusis@eneba.com>
Signed-off-by: Osvaldas Beniušis <osvaldas.beniusis@eneba.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants