Problem/Motivation

I have found that when a site uses more than one proxy server or Varnish or Cloudflare, module EU Cookie Compliance (GDPR Compliance) adds to DB Incorrect user's IP address after click to button "Accept all" or "Reject all".

Steps to reproduce

- check on project with Cloudflare, few proxy servers or locally can test with Varnish container
- install module and configure EU Cookie Compliance (GDPR Compliance) module
- open site by anonymous from Varnish container path and press button "Allow all" on popup cookie window
- check IP address in table "eu_cookie_compliance_basic_consent" of DB and see IP of Cloudflare, proxy server or Varnish container, not a user's IP address.

Proposed resolution

It is related to realization of method Plugin/ConsentStorage/BasicConsentStorage.php:registerConsent that get header "REMOTE_ADDR" when trusted proxies were not set via "setTrustedProxies()".

$ip_address = \Drupal::request()->getClientIp();

https://github.com/symfony/http-foundation/blob/6.3/Request.php#L788

I propose to get the first IP address from header "X-Forwarded-For", because if a request is chained through more than one proxy server, then each proxy adds the IP of the preceding one to the existing X-Forwarded-For header so that the entire chain is preserved. The first IP address in header "X-Forwarded-For" equals the user's IP address.

CommentFileSizeAuthor
#4 after_changes.png143.38 KBankondrat4
#4 before_changes.png125.08 KBankondrat4
Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

ankondrat4 created an issue. See original summary.

ankondrat4’s picture

Issue summary: View changes

ankondrat4’s picture

Status: Active » Needs review
StatusFileSize
new125.08 KB
new143.38 KB

I have added condition to get first IP address from header "X-Forwarded-For" if this header is available.
Merge request were created, please review.

svenryen’s picture

Version: 8.x-1.24 » 8.x-1.x-dev
Status: Needs review » Fixed

Looks good, merging.

Thanks for contributing!

  • svenryen committed a9be4949 on 8.x-1.x authored by ankondrat4
    Issue #3404608 by ankondrat4, svenryen: Incorrect user's IP address when...
svenryen’s picture

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.