{"categories":[{"label":"WWW/HTTP","url":"https://skillfed.io/packages/category/internet-www-http/7"},{"label":"Dynamic Content","url":"https://skillfed.io/packages/category/internet-www-http-dynamic-content/3"}],"enrichment":{"capability":"Django middleware that extracts the real client IP address from the X-Forwarded-For header by trusting a configurable depth of reverse proxies and sanitizing spoofed entries.","skillfed_tags":["reverse-proxy","security-headers","django-middleware"],"use_cases":["Running Django behind an AWS Elastic Load Balancer or similar managed proxy where you need accurate client IPs for logging and analytics.","Implementing IP-based rate limiting or geographic restrictions when requests arrive through a CDN or reverse proxy.","Rejecting spoofed X-Forwarded-For headers in strict security configurations to prevent attackers from bypassing IP-based access controls.","Exempting specific URLs (health checks, admin endpoints) from X-Forwarded-For validation while enforcing it elsewhere.","Debugging request chains by cleaning up the X-Forwarded-For header to remove extraneous entries added by misconfigured proxies."],"what_it_does":"django-xff is middleware that solves a common problem in reverse-proxy deployments: extracting the real client IP address from the X-Forwarded-For header. When requests pass through one or more reverse proxies (load balancers, CDNs, etc.), the original client IP gets buried in a comma-separated list of addresses. A malicious client can prepend fake IPs to this header to spoof their origin, potentially bypassing IP-based security checks or rate limiting.\n\nThe middleware works by trusting a fixed depth of proxies\u2014you tell it how many proxies sit between the client and your Django app, and it extracts the IP at the correct position in the chain. It can optionally sanitize the header, validate that the expected number of proxies are present, and reject requests that fail validation. Configuration is entirely through Django settings, with modes ranging from permissive (do nothing if the header is missing) to strict (reject any request that doesn't match the expected proxy depth).","worth_installing":"Yes, if you run Django behind one or more reverse proxies and need reliable client IP extraction. The middleware is straightforward to configure and has no external dependencies beyond Django. However, maintenance is dormant (last release 547 days ago); verify that it works with your specific Django and Python versions before relying on it in production, and monitor the repository for any security issues or compatibility breaks."},"id":"django-xff","links":{"html":"https://skillfed.io/packages/django-xff","md":"https://skillfed.io/packages/django-xff.md","pypi":"https://pypi.org/project/django-xff/"},"maintenance":{"status":"dormant"},"meta":{"latest_release":"2025-02-13","license_spdx":null,"license_treatment":"permissive","name":"django-xff","python_support":"unspecified","summary":"Django X-Forwarded-For Properly"},"popularity":{"monthly_downloads":93650,"position":13374,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"1.5.0"}