Repository navigation
Add X-Forwarded-For header to Get Token requests [SDK-1941] #240
Description
Please do not report security vulnerabilities here. The Responsible Disclosure Program details the procedure for disclosing security issues.
Thank you in advance for helping us to improve this library! Your attention to detail here is greatly appreciated and will help us respond as quickly as possible. For general support or usage questions, use the Auth0 Community or Auth0 Support. Finally, to avoid duplicates, please search existing Issues before submitting one here.
By submitting an Issue to this repository, you agree to the terms within the Auth0 Code of Conduct.
Describe the problem you'd like to have solved
I currently have an API that my customers hit to get a token. The API then uses Python to call Auth0 to exchange credentials for a token. The code uses
GetToken.login(),GetToken.client_credentials, andGetToken.refresh_token. I've noticed that the API supports using the X-Forwarded-For header so that I could include the customer's IP address and Auth0 would use that IP address for any anomaly detection and for logging activity instead of all customers being tied to my API's IP address. However, the auth0-python library does not support adding the X-Forwarded-For header to the request.
Describe the ideal solution
The auth0-python
GetTokenmethods support providing an X-Forwarded-For header to the request to the Auth0 API. This could either be a generic optionalheadersargument added to the method and those headers get added to the request or it could be a specific optionalx_forwarded_forargument that gets added to the request headers. That would allow me to inspect the IP address of my incoming request and add that to the request sent to the Auth0 API.
Alternatives and current work-arounds
I currently don't have any work-arounds in place, which means Auth0 only sees the IP address of my API resulting in one bad user potentially impacting all users. A possible work-around is to stop using the auth0-python library and to simply make requests directly to the Auth0 API myself.
Additional context
N/A
Activity
lbalmaceda commentedon Sep 3, 2020
@beck3905 As I read the above, I understand you are in a way "proxying" the authentication through your API between the user and auth0. And probably what would be best, in that case, is having the user to authenticate first on its own, asking for the
audienceof your API identifier, and then using their received access token to reach our to your API. Can you add more context around your use case, please?Regarding the main inquiry, yes, this SDK doesn't have support for custom headers on the methods it exposes. The base client class does accept a
headersargument for theirpostandgetfunctions, but having you construct the request yourself defeats a bit the purpose of the SDK. I think is a good feature request, provided we find your use case valid.beck3905 commentedon Sep 3, 2020
@lbalmaceda What you described is correct. I have my own
/oauth/tokenendpoint on my API that proxies to Auth0 and uses the auth0-python libraryauth0.v3.authentication.GetTokenclass to do it. We use this for our customers to access our API's directly rather than through a web application (we have those too and they login using the hosted pages). The proxy endpoint serves a couple of purposes for us. One is that we can abstract away some of the details required by the Auth0 authentication endpoints (e.g. client_id, client_secret, scopes, etc.). Another is so we can add additional logic into get token requests without hitting Auth0 (for example, we just had a situation where a single user was sending too many requests and getting rate limited by Auth0 and since we do not control that user's behavior we would not be able to stop them from hitting Auth0 directly and causing problems for our entire tenant. We were able to add a simple blacklist to our get token endpoint that allowed us to screen requests from the username and block them outright rather than sending them to Auth0.)[-]Add X-Forwarded-For header to Get Token requests[/-][+]Add X-Forwarded-For header to Get Token requests [SDK-1941][/+]lbalmaceda commentedon Sep 7, 2020
We're tracking this internally as
SDK-1941.stale commentedon Dec 6, 2020
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. If you have not received a response for our team (apologies for the delay) and this is still a blocker, please reply with additional information or just a ping. Thank you for your contribution! 🙇♂️
ca-simone-chiorazzo commentedon Nov 29, 2021
Hi, any news about the capability to set an
auth0-forwarded-forheader to the python SDK?brandong954 commentedon May 26, 2023
Any update? @adamjmcgrath
adamjmcgrath commentedon Jun 22, 2023
@brandong954 Have raised a PR to support the
auth0-forwarded-forheader #501