Closes #2371

ArchiSteamFarm/IPC/Integration/ApiAuthenticationMiddleware.cs

@@ -87,16 +87,32 @@ private static async Task<HttpStatusCode> GetAuthenticationStatus(HttpContext co
 				throw new InvalidOperationException(nameof(ClearFailedAuthorizationsTimer));
 			}
 
+			IPAddress? clientIP = context.Connection.RemoteIpAddress;
+
+			if (clientIP == null) {
+				throw new InvalidOperationException(nameof(clientIP));
+			}
+
 			string? ipcPassword = ASF.GlobalConfig != null ? ASF.GlobalConfig.IPCPassword : GlobalConfig.DefaultIPCPassword;
 
 			if (string.IsNullOrEmpty(ipcPassword)) {
-				return HttpStatusCode.OK;
-			}
+				if (IPAddress.IsLoopback(clientIP)) {
+					return HttpStatusCode.OK;
+				}
 
-			IPAddress? clientIP = context.Connection.RemoteIpAddress;
+				if (Startup.KnownNetworks.IsEmpty) {
+					return HttpStatusCode.Forbidden;
+				}
 
-			if (clientIP == null) {
-				throw new InvalidOperationException(nameof(clientIP));
+				if (clientIP.IsIPv4MappedToIPv6) {
+					IPAddress mappedClientIP = clientIP.MapToIPv4();
+
+					if (Startup.KnownNetworks.Any(network => network.Contains(mappedClientIP))) {
+						return HttpStatusCode.OK;
+					}
+				}
+
+				return Startup.KnownNetworks.Any(network => network.Contains(clientIP)) ? HttpStatusCode.OK : HttpStatusCode.Forbidden;
 			}
 
 			if (FailedAuthorizations.TryGetValue(clientIP, out byte attempts)) {

ArchiSteamFarm/IPC/Startup.cs

@@ -29,6 +29,7 @@
 #endif
 using System;
 using System.Collections.Generic;
+using System.Collections.Immutable;
 using System.Globalization;
 using System.Net;
 using System.Reflection;
@@ -53,6 +54,8 @@
 
 namespace ArchiSteamFarm.IPC {
 	internal sealed class Startup {
+		internal static ImmutableHashSet<IPNetwork> KnownNetworks { get; private set; } = ImmutableHashSet<IPNetwork>.Empty;
+
 		private readonly IConfiguration Configuration;
 
 		public Startup(IConfiguration configuration) => Configuration = configuration ?? throw new ArgumentNullException(nameof(configuration));
@@ -148,12 +151,12 @@ public void Configure(IApplicationBuilder app, IWebHostEnvironment env) {
 			app.UseRouting();
 #endif
 
+			// We want to protect our API with IPCPassword and additional security, this should be called after routing, so the middleware won't have to deal with API endpoints that do not exist
+			app.UseWhen(context => context.Request.Path.StartsWithSegments("/Api", StringComparison.OrdinalIgnoreCase), appBuilder => appBuilder.UseMiddleware<ApiAuthenticationMiddleware>());
+
 			string? ipcPassword = ASF.GlobalConfig != null ? ASF.GlobalConfig.IPCPassword : GlobalConfig.DefaultIPCPassword;
 
 			if (!string.IsNullOrEmpty(ipcPassword)) {
-				// We want to protect our API with IPCPassword, this should be called after routing, so the middleware won't have to deal with API endpoints that do not exist
-				app.UseWhen(context => context.Request.Path.StartsWithSegments("/Api", StringComparison.OrdinalIgnoreCase), appBuilder => appBuilder.UseMiddleware<ApiAuthenticationMiddleware>());
-
 				// We want to apply CORS policy in order to allow userscripts and other third-party integrations to communicate with ASF API, this should be called before response compression, but can't be due to how our flow works
 				// We apply CORS policy only with IPCPassword set as an extra authentication measure
 				app.UseCors();
@@ -194,10 +197,9 @@ public void ConfigureServices(IServiceCollection services) {
 			// Prepare knownNetworks that we'll use in a second
 			HashSet<string>? knownNetworksTexts = Configuration.GetSection("Kestrel:KnownNetworks").Get<HashSet<string>>();
 
-			HashSet<IPNetwork>? knownNetworks = null;
-
 			if (knownNetworksTexts?.Count > 0) {
-				knownNetworks = new HashSet<IPNetwork>(knownNetworksTexts.Count);
+				// Use specified known networks
+				HashSet<IPNetwork> knownNetworks = new();
 
 				foreach (string knownNetworkText in knownNetworksTexts) {
 					string[] addressParts = knownNetworkText.Split('/', StringSplitOptions.RemoveEmptyEntries);
@@ -211,17 +213,17 @@ public void ConfigureServices(IServiceCollection services) {
 
 					knownNetworks.Add(new IPNetwork(ipAddress, prefixLength));
 				}
+
+				KnownNetworks = knownNetworks.ToImmutableHashSet();
 			}
 
 			// Add support for proxies
 			services.Configure<ForwardedHeadersOptions>(
 				options => {
 					options.ForwardedHeaders = ForwardedHeaders.All;
 
-					if (knownNetworks != null) {
-						foreach (IPNetwork knownNetwork in knownNetworks) {
-							options.KnownNetworks.Add(knownNetwork);
-						}
+					foreach (IPNetwork knownNetwork in KnownNetworks) {
+						options.KnownNetworks.Add(knownNetwork);
 					}
 				}
 			);