Members showing as localhost

[mjda]

XF has had automatic handling of Cloudflare IPs for a while. Since this was happening prior to using Cloudflare it's likely there's some other server configuration issue at play here.

You may wish to check admin.php?tools/phpinfo for the values of $_SERVER['REMOTE_ADDR'] and $_SERVER['HTTP_CF_CONNECTING_IP'] for clues.

Both of those are showing just my IP address.

 

[mjda]

I guess it's worth noting that this isn't affecting ALL users. There are only a handful of users who are showing as localhost. Everyone else's IP appears to be normal.

 

[Jeremy P]

What about $_SERVER['HTTP_CLIENT_IP'] and $_SERVER['HTTP_X_FORWARDED_FOR']?

 

[mjda]

What about $_SERVER['HTTP_CLIENT_IP'] and $_SERVER['HTTP_X_FORWARDED_FOR']?

There is no HTTP_CLIENT_IP showing and the other is my IP address.

 

[Jeremy P]

I guess it's worth noting that this isn't affecting ALL users. There are only a handful of users who are showing as localhost. Everyone else's IP appears to be normal.

Oh, if it doesn't affect you then it won't show any anomalies for you in phpinfo.

You might try commenting out the REMOTE_ADDR lines in your config.php. XF should already set the real IP properly when a request comes from Cloudflare, and it's possible some users are using other proxies that pass values which aren't safe to blindly trust. Otherwise I would imagine it has to be some kind of web server misconfiguration.

 

[mjda]

You might try commenting out the REMOTE_ADDR lines in your config.php. XF should already set the real IP properly when a request comes from Cloudflare, and it's possible some users are using other proxies that pass values which aren't safe to blindly trust.

Thank you! I'll try this instead.

Otherwise I would imagine it has to be some kind of web server misconfiguration.

This is exactly what I'm trying to figure out so that, if this is the case, I can then figure out what the issue is and get it fixed.

Again, thanks for your reply. I'll remove the lines in my config.php and see what happens over the next several days.

 

[VBX Co]

Do you have Nginx in the mix at all?

 

[mjda]

Do you have Nginx in the mix at all?

No, I have Apache installed. Honestly, I don't know much about servers so just the thought of trying to migrate from Apache to Nginx gives me a headache. I have a managed server with Knownhost so, if there is a mis-configuration issue with the server, I'd probably submit a ticket for them to fix it for me.

 

[mjda]

Just as an update to this, one of the members who usually shows up as localhost logged in this morning and his real IP is now showing. Of course, he could be accessing the site from a different device/ISP/etc, but it's been quite some time since he's not shown as localhost so hopefully that means it's fixed.

I'll keep monitoring and reply again if the localhost issue pops back up.

 

[MentaL]

Just as an update to this, one of the members who usually shows up as localhost logged in this morning and his real IP is now showing. Of course, he could be accessing the site from a different device/ISP/etc, but it's been quite some time since he's not shown as localhost so hopefully that means it's fixed.

I'll keep monitoring and reply again if the localhost issue pops back up.

what did you change?

 

[mjda]

what did you change?

I removed the two lines from my config.php as @Jeremy P suggested.

The more I think about it, though, the more I think it might've had something to do with my old CDN setup. I'm wondering if people were still connecting directly to the site, and using the old CDN, even after I switched the nameservers to Cloudflare, because of DNS caching.

In any case, it appears to be fixed. Two of the members who normally were showing as localhost logged in yesterday and both of them showed their real IP. Again, no guarantee that they would have showed as localhost at those times anyways but I'm pretty confident it's fixed now. I'm continuing to monitor it and, as I said, I'll post back here if there are more issues with this.

 

[MentaL]

I removed the two lines from my config.php as @Jeremy P suggested.

The more I think about it, though, the more I think it might've had something to do with my old CDN setup. I'm wondering if people were still connecting directly to the site, and using the old CDN, even after I switched the nameservers to Cloudflare, because of DNS caching.

In any case, it appears to be fixed. Two of the members who normally were showing as localhost logged in yesterday and both of them showed their real IP. Again, no guarantee that they would have showed as localhost at those times anyways but I'm pretty confident it's fixed now. I'm continuing to monitor it and, as I said, I'll post back here if there are more issues with this.

How long ago was the CDN switch? DNS propagates fast and cache tends to clear quickly depending on the users setup. Direct connections SHOULD in theory negate any proxy impact and thus giving the users source ip more easily, adding CF as a middle man would lead me to believe a complication could occur with misconfigurations. The fact its the opposite is interesting. Evidently, your configuration is troublesome but I'm glad you resolved it.

 

[mjda]

How long ago was the CDN switch? DNS propagates fast and cache tends to clear quickly depending on the users setup. Direct connections SHOULD in theory negate any proxy impact and thus giving the users source ip more easily, adding CF as a middle man would lead me to believe a complication could occur with misconfigurations. The fact its the opposite is interesting. Evidently, your configuration is troublesome but I'm glad you resolved it.

Yeah, it's all confusing to me. I just don't want there to be any kind of misconfigurations on my server. I'm not sure how that'd happen, though, because I only change things in cPanel and I only use the stable version. I went ahead and re-provisioned the server last night with EasyApache, so hopefully if there was something screwy in there that fixed it.

That said, if it does come down to looking like a server misconfiguration, I do pay for managed services through Knownhost so I'm sure they'd take a look for me if necessary. Again, though, everything appears to be working fine now. Hopefully things stay that way.