We're using JWilder's excellent dockergen switchboard to proxy vhosts on our main server. Like most nginx proxies, it sets an X-Forwarded-For header but it can't mask it's own IP address on each request. As a result, when one user attempts to many incorrect logins, all users are locked out of the server until the timeout expires. I've set the flood control to be fairly permissive but I'd rather just tell Drupal to respect the header because too many people are being locked out and permissive settings are a security risk.

TCP documentation states that applications which perform IP-level logic should respect the X-Forwarded-For header. How can I get Drupal's flood control to do so, and to stop locking legitimate users out of the server?

Apparently, Aquia had the same problem some years ago so there must be some solution...

Browse other questions tagged or ask your own question.