Improve loopback address detection (HangfireIO#2436)

cezar-pimentel · Aug 28, 2024 · 43c5456 · 43c5456
1 parent 4e95258
commit 43c5456
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/src/Hangfire.Core/Dashboard/LocalRequestsOnlyAuthorizationFilter.cs b/src/Hangfire.Core/Dashboard/LocalRequestsOnlyAuthorizationFilter.cs
@@ -15,6 +15,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.Net;
 
 namespace Hangfire.Dashboard
 {
@@ -39,7 +40,8 @@ public bool Authorize(DashboardContext context)
             if (context.Request.RemoteIpAddress == context.Request.LocalIpAddress)
                 return true;
 
-            return false;
+            // Handle addresses such as ::ffff:127.0.0.1 (IP v4 mapped to IP v6)
+            return IPAddress.TryParse(context.Request.RemoteIpAddress, out IPAddress address) && IPAddress.IsLoopback(address);
         }
 
 #if FEATURE_OWIN
@@ -59,7 +61,8 @@ public bool Authorize(IDictionary<string, object> owinEnvironment)
             if (context.Request.RemoteIpAddress == context.Request.LocalIpAddress)
                 return true;
 
-            return false;
+            // Handle addresses such as ::ffff:127.0.0.1 (IP v4 mapped to IP v6)
+            return IPAddress.TryParse(context.Request.RemoteIpAddress, out IPAddress address) && IPAddress.IsLoopback(address);
         }
 #endif
     }