Security logs: Incorrect Browser Information and IP address displayed in Security Logs for all entries #10856

2 Answer(s)

• 

  0

  maliming created one month ago

  Support Team Fullstack Developer

  Hi,

  The Browser column keeps the raw User-Agent header, and every modern browser sends one that starts with Mozilla/5.0. Chrome, Edge and Firefox are named further along the same string, so the column width is what hides them, not the recorded value.

  The IP address is a different case. One address on every entry, and a link-local one at that, is what you get when the application runs behind a reverse proxy: the generated host never takes the client address from X-Forwarded-For, so each entry is stamped with the proxy IP instead. Add this at the end of ConfigureServices in the module that serves the login page (*HttpApiHostModule, or *AuthServerModule if your solution has a separate auth server):

  Configure<ForwardedHeadersOptions>(options =>
  {
      options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
      options.KnownNetworks.Clear();
      options.KnownProxies.Clear();
  });
  

  The two Clear() calls are the part that is easy to miss. The middleware trusts only loopback addresses out of the box, so without them X-Forwarded-For is dropped without any error and you keep seeing the proxy address. Clear them only when your application cannot be reached except through the proxy, otherwise a caller that bypasses it can spoof its IP. On .NET 10 the same list is named KnownIPNetworks.

  For the truncated columns you can show the full User-Agent and application name on hover with an entity prop contributor:

  // src/app/security-log-prop-contributors.ts
  import { escapeHtmlChars } from '@abp/ng.core';
  import { EntityProp, EntityPropList } from '@abp/ng.components/extensible';
  import { IdentitySecurityLogDto } from '@volo/abp.commercial.ng.ui/config';
  import { eIdentityComponents } from '@volo/abp.ng.identity';
  import { of } from 'rxjs';
  
  function showFullValueOnHover(
    propList: EntityPropList<IdentitySecurityLogDto>,
    name: 'browserInfo' | 'applicationName',
  ) {
    const index = propList.indexOf(name, (value, propName) => value.name === propName);
    const droppedNode = propList.dropByIndex(index)!;
  
    propList.addByIndex(
      new EntityProp<IdentitySecurityLogDto>({
        ...droppedNode.value,
        valueResolver: data => {
          const value = escapeHtmlChars(data.record[name]) || '';
  
          return of(`&lt;div class=&quot;abp-ellipsis-inline&quot; title=&quot;${value}&quot;&gt;${value}&lt;/div&gt;`);
        },
      }),
      index,
    );
  }
  
  // The exported contributor type does not list the security logs page yet.
  export const identityEntityPropContributors = {
    [eIdentityComponents.SecurityLogs]: [
      (propList: EntityPropList<IdentitySecurityLogDto>) => {
        showFullValueOnHover(propList, 'browserInfo');
        showFullValueOnHover(propList, 'applicationName');
      },
    ],
  } as any;
  

  Then pass it to the identity route in app.routes.ts:

  {
    path: 'identity',
    loadChildren: () =>
      import('@volo/abp.ng.identity').then(c =>
        c.createRoutes({ entityPropContributors: identityEntityPropContributors }),
      ),
  },
  

  The next release will show the full value on hover without this contributor, and the contributor type will accept the security logs page so the cast is no longer needed.

  Thanks

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  maliming created one month ago

  Support Team Fullstack Developer

  Hi,

  We've refunded the credit for this ticket.

  Thanks

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel