From eed947b20700572b82660f5edc01a2d3df895f96 Mon Sep 17 00:00:00 2001 From: cproudlock Date: Thu, 16 Jul 2026 15:27:45 -0400 Subject: [PATCH] Forward real client IPs through waitress trusted-proxy flags The X-Forwarded-For rewrite rule alone is not enough: waitress 2+ strips forwarded headers from untrusted proxies by default, so the app still saw 127.0.0.1 with the rule active. Trust the loopback proxy and consume x-forwarded-for on the waitress command line; waitress then rewrites remote_addr to the real client. Runbook gains the allowedServerVariables unlock (500.52) and both troubleshooting rows. --- deploy/windows/web.config | 2 +- docs/INSTALL-WINDOWS-IIS.md | 11 +++++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/deploy/windows/web.config b/deploy/windows/web.config index fe712b0..4821797 100644 --- a/deploy/windows/web.config +++ b/deploy/windows/web.config @@ -28,7 +28,7 @@ default**. It needs the URL Rewrite module; with it active but the module > absent, IIS returns 500.19. Install URL Rewrite, then uncomment the > `` block, to record real client IPs in audit logs. +> +> Two companion requirements, or the app keeps seeing 127.0.0.1: +> `allowedServerVariables` is locked at server level by default (500.52 when +> the block activates) - unlock once with +> `appcmd unlock config -section:system.webServer/rewrite/allowedServerVariables`. +> And waitress 2+ strips X-Forwarded-For from untrusted proxies, so the +> waitress `arguments` line must carry +> `--trusted-proxy=127.0.0.1 --trusted-proxy-headers=x-forwarded-for` +> (the shipped web.config already does). --- @@ -224,6 +233,8 @@ each gets its own site, app pool, port, and venv. | --- | --- | | `flask db upgrade` -> error **1071** | MySQL 5.6 without the step-1 flags (or server not restarted). | | IIS **500.19** | handler sections not unlocked (step 7.4), or the `` block active without URL Rewrite. | +| IIS **500.52** after enabling the rewrite block | `allowedServerVariables` locked at server level - `appcmd unlock config -section:system.webServer/rewrite/allowedServerVariables`. | +| Audit log shows only **127.0.0.1** with the rewrite block active | waitress strips untrusted proxy headers - `--trusted-proxy=127.0.0.1 --trusted-proxy-headers=x-forwarded-for` missing from the waitress `arguments`. | | **500** with an empty HttpPlatform log | app-pool identity can't read `APP_ROOT` / run the venv (step 7.3), or `.env` missing/invalid. | | "No time zone found with key America/New_York" | `tzdata` not installed (`pip install tzdata`). | | Nav missing Equipment/PCs/... | plugins not installed (step 6 `flask plugin install`), or site not recycled. |