mirror of
https://github.com/r-smith/deceptifeed.git
synced 2025-11-02 13:13:37 +00:00
375da6eeac
This change updates the logging behavior of the HTTP honeypot. If a custom custom source IP header is configured: - The actual connecting IP is logged as `remote_ip`. - The IP extracted from the header is logged as `source_ip`. - Any problems extracting an IP from the header results in `source_ip` falling back to the actual connecting IP. - A new `source_ip_parsed` field indicates whether an IP was extrracted from the header. - If parsing fails, a `source_ip_error` field is included with the error message. If no custom header is configured, logging behavior remains unchanged. This change improves usability of the threat feed web interface when you have HTTP honeypots behind a proxy. By logging the original client IP as `source_ip`, the application now correctly displays the actual source of the connection, rather than your proxy's IP address.