Some proxies give an X-Forwarded-For (XFF) header, with the IP address
of the user for whom they are forwarding a request. This is how our web
servers get the IP addresses of users, despite the fact that they are
behind a battery of squids configured as "accelerators". It's been
suggested before that if a user is behind a proxy, we should display
their real IP address as reported by X-Forwarded-For, rather than the
address of the proxy. But if we did this, anyone could forge the XFF
header and masquerade as another user. Also, the XFF header often
contains private addresses which are not unique, e.g. 192.168.0.1.
Some ISPs force their users to use a proxy, and some of these proxies
give a valid XFF header. These ISPs can be reasonably trusted not to
forge the header. Thus, it makes sense to use whatever user-specific
address they report, for the purposes of blocking and user
identification. This is what I've just implemented -- a means to specify
a list of partially trusted proxies. Most of the code was already written.
Walter von Kalken's open proxy is in this category, and I have entered
it into the list. Thus he will no longer be blocked by the SORBS
blocklist. We should probably set up a page somewhere with suggestions
for additions.
-- Tim Starling