4 ms·
Is this in X-Forwarded-For?
by dsl 8y ago
Is this in X-Forwarded-For?
- prdonahue 8y agoCF-Connecting-IP is what we recommend using. See https://support.cloudflare.com/hc/en-us/articles/200170986-How-does-Cloudflare-handle-HTTP-Request-headers- https://support.cloudflare.com/hc/en-us/articles/200170986-H... for details.
- devicenull 8y agoWhich presumably only works if your site is using Cloudflare? Since you wouldn't be MITMing SSL in order to inject this header?
- zackbloom 8y agoThis is correct. It's significantly harder to inject the origin IP into a TCP stream. We have ways [1] of doing it, but it requires some coordination on both sides. 1- https://blog.cloudflare.com/mmproxy-creative-way-of-preserving-client-ips-in-spectrum/ https://blog.cloudflare.com/mmproxy-creative-way-of-preservi...
- dsl 8y agoHave you considered enabling this out of band? For example as a network administrator I could verify a CIDR block and receive a real time stream of 5-tuples (err, 7-tuples with the proxy?) destined to my network.
- topranks 8y agoHow can they do this? Are Cloudflare going to be able to decrypt the TLS sessions running over their VPN between me and end-sites, so they can insert this additional HTTP header? Doesn’t sound feasible.
- X-Istence 8y agoWhen most of those sites are hosted by Cloudflare, they already decrypt the TLS session at their load balancers before forwarding the request to the remote endpoint.