feat!: Use more-trusted IP in rate-limiting (#241)

cms/envs/devstack.py

@@ -278,3 +278,7 @@ def should_show_debug_toolbar(request):  # lint-amnesty, pylint: disable=missing
 
 # Don't form the return redirect URL with HTTPS on devstack
 SOCIAL_AUTH_REDIRECT_IS_HTTPS = False
+
+#################### Network configuration ####################
+# Devstack is directly exposed to the caller
+CLOSEST_CLIENT_IP_FROM_HEADERS = []

cms/envs/test.py

@@ -348,3 +348,7 @@
 
 ############### Settings for proctoring  ###############
 PROCTORING_USER_OBFUSCATION_KEY = 'test_key'
+
+#################### Network configuration ####################
+# Tests are not behind any proxies
+CLOSEST_CLIENT_IP_FROM_HEADERS = []

lms/envs/devstack.py

@@ -446,6 +446,10 @@ def should_show_debug_toolbar(request):  # lint-amnesty, pylint: disable=missing
 #################### Webpack Configuration Settings ##############################
 WEBPACK_LOADER['DEFAULT']['TIMEOUT'] = 5
 
+#################### Network configuration ####################
+# Devstack is directly exposed to the caller
+CLOSEST_CLIENT_IP_FROM_HEADERS = []
+
 ################# New settings must go ABOVE this line #################
 ########################################################################
 # See if the developer has any local overrides.

lms/envs/test.py

@@ -624,3 +624,7 @@
 # rate limit for /api/v1/save/course/ api
 SAVE_FOR_LATER_IP_RATE_LIMIT = '5/d'
 SAVE_FOR_LATER_EMAIL_RATE_LIMIT = '5/m'
+
+#################### Network configuration ####################
+# Tests are not behind any proxies
+CLOSEST_CLIENT_IP_FROM_HEADERS = []

openedx/core/djangoapps/util/ratelimit.py

@@ -3,11 +3,22 @@
 """
 from uuid import uuid4
 
-from ipware.ip import get_client_ip
+from openedx.core.djangoapps.util import ip
 
 
 def real_ip(group, request):  # pylint: disable=unused-argument
-    return get_client_ip(request)[0]
+    """
+    Get a client IP suitable for use in rate-limiting.
+
+    To prevent evasion of rate-limiting, use the safest (rightmost) IP in the
+    external IP chain.
+
+    (Intended to be called by ``django-ratelimit``, hence the unused argument.)
+    """
+    if ip.USE_LEGACY_IP.is_enabled():
+        return ip.get_legacy_ip(request)
+    else:
+        return ip.get_safest_client_ip(request)
 
 
 def request_post_email(group, request) -> str:  # pylint: disable=unused-argument