Use the IP address of the client that connected to CloudFront

DemocracyClub · Sep 25, 2024 · 92ab335 · 92ab335
1 parent 94dbb67
commit 92ab335
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/wcivf/apps/feedback/views.py b/wcivf/apps/feedback/views.py
@@ -28,7 +28,11 @@ def is_spam(self):
         akismet_client = akismet.SyncClient.validated_client(config=config)
 
         return akismet_client.comment_check(
-            user_ip=self.request.META["REMOTE_ADDR"],
+            # The IP address of the client that connected to CloudFront,
+            # not the IP of the connecting client (ALB or CloudFront).
+            user_ip=self.request.META["HTTP_X_FORWARDED_FOR"]
+            .split(",")[0]
+            .strip(),
             comment_content=self.request.POST.get("comments"),
             comment_type="feedback",
             comment_author=self.request.META.get("HTTP_USER_AGENT"),