asaaki / capture-the-ip

Claim as many IPs as you can and become a block owner

Hi there! 👋🏻

• 🦀 I love Rust. Use it as a hobbyist, but work would be cool.
• 💎 I (mainly) work with Ruby, JavaScript, and TypeScript.
• 🐳 I use Docker and Kubernetes.
• 🌍 I terraform that on AWS.
• 👪 I'm glue. I help and enable and unblock teams.
• ✍🏻 I blog about stuff at markentier.tech

capture-the-ip's Issues

Access-Control-Allow-Origin: *

Hello, I was wondering if it would be possible for you to add the HTTP header "Access-Control-Allow-Origin: *" to responses to the claim page. This would make it so sites with a Cross Origin Embedder Policy of require-corp are able to load the claim page. Thank you!

Don't trust X-Forwarded-For and related headers by default

X-Forwarded-For/X-Real-IP/CF-Connecting-IP/etc should not be used as a source of IPs if CTI is not actually behind a reverse proxy.
(Maybe it should be a config option of some sort, along with a way to configure which IPs such headers can be accepted from)

Example:

Someone seems to have abused this already: