Lucee in Docker - ignoring X-Forwarded-For

Zackster · April 15, 2025, 10:09am

are you using the 6.2.1 RC? that docker image comes with Tomcat 11

https://tomcat.apache.org/tomcat-11.0-doc/config/valve.html#Remote_IP_Valve

lucee/lucee-dockerfiles/blob/master/config/tomcat/11.0/server.xml#L157


      
                 resources under the key "UserDatabase".  Any edits
                 that are performed against this UserDatabase are immediately
                 available for use by the Realm.  -->
            <!-- <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
                   resourceName="UserDatabase"/> -->
          <!-- </Realm> -->
          
          <Host name="127.0.0.1"  appBase="webapps"
                unpackWARs="true" autoDeploy="true">
          
            <Valve className="org.apache.catalina.valves.RemoteIpValve"
                   remoteIpHeader="X-Forwarded-For"
                   requestAttributesEnabled="true" />
          
            <Valve className="org.apache.catalina.valves.ErrorReportValve" 
                   showReport="false" showServerInfo="false" />
          
            <!-- SingleSignOn valve, share authentication between web applications
                 Documentation at: /docs/config/valve.html -->
            <!--
            <Valve className="org.apache.catalina.authenticator.SingleSignOn" />

thefalken · April 15, 2025, 10:32am

This is on 6.2.0.321 but there’s a non-zero chance I’ve nuked the default server.xml in adding our own list of Hosts (we try and avoid mod_cfml for production because it eats the first request)…

Having it in the context.xml saves repeating it in that use case of multiple Host entries ?

Zackster · April 15, 2025, 10:49am

as per the tomcat docs

This Valve may be used at the Engine , Host or Context level as required. Normally, this Valve would be used at the Engine level.

Which it already is in the lucee docker images?

unless you are deploying today, seriously, use the latest 6.2.1, it’s about to go stable and has a lot of bug fixes you’ll be battling otherwise