When proxy_mode is enabled, Odoo takes the client address from the X-Forwarded-For header, but it only trusts one proxy: it always takes the last address of the header. Behind more than one reverse proxy (for example a cloud load balancer in front of an ingress controller), that address is one of your own proxies, not the client.
This module lets you configure how many proxies Odoo trusts. Odoo then uses the address added by your outermost proxy, which is the real client.
This affects every place that uses the client address, for example the access log, the login log, the login cooldown after failed attempts, reCAPTCHA, and website visitors.
Table of contents
You don’t have to install this module in a database. Add it to the server_wide_modules list so it is active as soon as the server starts:
server_wide_modules = base,web,proxy_trusted_hops
Set the number of reverse proxies in front of Odoo, either with the ODOO_TRUSTED_PROXIES environment variable or in a [proxy_trusted_hops] section of the Odoo configuration file:
[options] proxy_mode = True [proxy_trusted_hops] trusted_proxies = 2
The environment variable takes precedence over the configuration file. When the server_environment module is on the addons path, the section is read through it, so it can also come from its environment files; the Odoo configuration file is still included there.
As in Odoo itself, the header is only used when proxy_mode is enabled and the request contains an X-Forwarded-Host header.
With trusted_proxies = N, Odoo uses the N-th address from the end of the X-Forwarded-For header. If the header contains fewer addresses than that, Odoo keeps the address of the connecting proxy.
Security warning: the client can send its own X-Forwarded-For header, and proxies only add their entry to it. Never set a value higher than the number of proxies that actually add an entry: otherwise the client decides which address Odoo sees, and can for example get around the login cooldown. Each proxy must add its entry to the header.
Check the server log at startup:
INFO ? odoo.addons.proxy_trusted_hops.patch: Trusting 2 proxies for the X-Forwarded-For header.
Bugs are tracked on GitHub Issues. In case of trouble, please check there if your issue has already been reported. If you spotted it first, help us to smash it by providing a detailed and welcomed feedback.
Do not contact contributors directly about support or help with technical issues.
This module is maintained by the OCA.
OCA, or the Odoo Community Association, is a nonprofit organization whose mission is to support the collaborative development of Odoo features and promote its widespread use.
This module is part of the OCA/server-tools project on GitHub.
You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.