Endpoints and api key ip address restriction

[ton...@gmail.com]

I have a Endpoint API setup with app engine flexible backend. 

I'm adding api key restriction, which is working fine if there is no restriction for the api key.

I'm trying to add IP address restriction with my client public IP address. But when I call the API with the API key, I got "IP address blocked" message.

How to setup the IP address restriction? What is the correct IP address to put in the list to allow pass through?

Thanks,

Tong

[Sepehr Ebrahimzadeh]

Hi Tong,

We are investigating this and can confirm that there's a bug in the way that the Endpoints Server Proxy identifies client IP addresses.

This leads to the API Key feature's IP address restrictions not working properly in some environments like AppEngine Flex. 

We are working to fix this ASAP.

Thank you for reporting the problem! We will update the thread as soon as the issue is fixed and rolled out to production.

Regards,

Sep

Cloud Endpoints team

[Tong Du]

Hi Sep,

Yes, I have my test code always get ip address '172.18.0.3', might be internal ip address of the proxy.

Hope it can be addressed soon.

Thanks,

Tong

[Tong Du]

Hi Sep,

A related question, is the HTTP referrers (web sites) also having issue due to the same bug?

I'm trying this domain restriction and did the following test:

1. One service has a web page, python server side rendering by calling an API to get some database record. It hosted in https://<service id>-dot-<project id>.appspot.com/test
2. The API got called were hosted in another service, wrapped with Endpoints, and set HTTP referrer as "*<project id>.appspot.com/*"
3. But I got error message "Referer blocked."

Thanks,

Tong

[ca...@novoda.com]

I see similar issues where the IP that is defined is blocked by endpoint. 

[ca...@novoda.com]

If I enable just 1 IP, it works. More than one and it fails.

Disclaimer: The information in this e-mail and any attachments is the property of Novoda Ltd and is confidential and may be legally privileged. This e-mail is intended solely for the person or organisation to which it is addressed. Any disclosure, copying or other use of the information by any person or organisation who is not the intended recipient is strictly prohibited and may be unlawful. If you have received this e-mail in error, please inform the sender immediately and delete/destroy this e-mail and any copies of it. Novoda Ltd has taken reasonable precautions to minimise the risk of any software viruses which may damage your systems, but we advise that you take the necessary steps to ensure that no virus contamination is suffered. Novoda Ltd does not accept any liability for any loss or damage caused by the transmission of any virus.

Novoda Ltd, Company No: 347444, Registered in Scotland Registered Office: C/O Alexander Sloan, 38 Cadogan Street, Glasgow, G2 7HF, Scotland.  VAT Registration Number  GB 984 2525 93

--
You received this message because you are subscribed to a topic in the Google Groups "Google Cloud Endpoints" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/google-cloud-endpoints/UxbUy3lIIDE/unsubscribe.
To unsubscribe from this group and all its topics, send an email to google-cloud-endpoints+unsub...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-cloud-endpoints/da26db7c-7a87-4050-a9fc-238f9ee260f4%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

Regards, Carl-Gustaf Harroch | CTO @ Novoda.com
Tel: +44 (0) 7 725 721 005

Disclaimer: The information in this e-mail and any attachments is the property of Novoda Ltd and is confidential and may be legally privileged. This e-mail is intended solely for the person or organisation to which it is addressed. Any disclosure, copying or other use of the information by any person or organisation who is not the intended recipient is strictly prohibited and may be unlawful. If you have received this e-mail in error, please inform the sender immediately and delete/destroy this e-mail and any copies of it. Novoda Ltd has taken reasonable precautions to minimise the risk of any software viruses which may damage your systems, but we advise that you take the necessary steps to ensure that no virus contamination is suffered. Novoda Ltd does not accept any liability for any loss or damage caused by the transmission of any virus.

Novoda Ltd, Company No: 347444, Registered in Scotland Registered Office: C/O Alexander Sloan, 38 Cadogan Street, Glasgow, G2 7HF, Scotland.  VAT Registration Number  GB 984 2525 93

[Sepehr Ebrahimzadeh]

Yes this is the same bug and we are actively working on fixing it in ESP.

Thanks,

Sep

[pmaz...@quantumscape.com]

I am also receiving the error "IP address blocked" on my AppEngine Flexible instance despite whitelisting my public IP address.  Is this issue still active?

[Dan Ciruli]

We are investigating this now and will report back here.

[pmaz...@quantumscape.com]

Any updates on this issue? 

[Dan Ciruli]

I've asked engineering for an update and will post the update here.

[Paul Mazzuca]

Just wanted also add that this also does not work in GKE with Google Endpoints.  In the previous post, I only said that it affected AppEngine Flexible

[jama...@paradigmadigital.com]

Any update?

[Dan Ciruli]

Yes!

In a GCE and GKE, ESP takes X-Forwarded-For header with "--xff_trusted_proxy_list" option  to take the real IP address.

And in a FLEX environment, X-User-IP is used.

Both are in production.  https://github.com/cloudendpoints/endpoints-tools/pull/17 are pull request which were merged.

On Wednesday, December 20, 2017 at 7:04:26 AM UTC-8, ja--...@paradigmadigital.com wrote:

Any update?

[aam044]

Dan - is it possible that this issue is back?

I just deploy flex appengine - and as soon as set limit on API key to IPs - nothing work and error is 

{

 "code": 7,

 "message": "IP address blocked.",

 "details": [

  {

   "@type": "type.googleapis.com/google.rpc.DebugInfo",

   "stackEntries": [],

   "detail": "service_control"

  }

 ]

[Dan Ciruli]

I've got someone in engineering looking into this now.

DC

--
You received this message because you are subscribed to the Google Groups "Google Cloud Endpoints" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-cloud-endp...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-cloud-endpoints/c9c40501-f0bd-4808-a41d-a0e13ddc8e2c%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

DC

[fabio.c...@gmail.com]

Having the same problem. 
Flex, IP range restriction, and getting 

{

 "code": 7,

 "message": "IP address blocked.",

 "details": [

  {

   "@type": "type.googleapis.com/google.rpc.DebugInfo",

   "stackEntries": [],

   "detail": "service_control"

  }

 ]

}

My client is not impressed...

Is there any update please? 

Thanks

F