3 ms·

From the article: > X-FORWARDED-FOR: 1.2.3.4 (yes, we can override this header with whatever we want !) Why aren't you guys disallowing that field from having

From the article: > X-FORWARDED-FOR: 1.2.3.4 (yes, we can override this header with whatever we want !) Why aren't you guys disallowing that field from having any external value?

modoc 6y ago
Because it's legitimate to have values before the request gets to CloudFlare, for instance if it was routed out through a corporate proxy, etc..
- MuffinFlavored 6y ago
  Ouch. I wonder if it's time to cryptographically sign those values or add a checksum or something.
  - acdha 6y ago
    Basically this is why you want to go full zero trust: if you use mutual authentication over TLS, this becomes much less of a concern since you’re not trying to craft policies based on IP addresses with multiple intermediaries.
- ec109685 6y ago
  Only possible if non-TLS or the company is man in the middling TLS (and certificate pinning isn’t enabled).
  - allending 6y ago
    So... completely possible then.
kentonv 6y ago
So we're supposed to be appending the client's IP to whatever the client sent for X-Forwarded-For, documented here: https://support.cloudflare.com/hc/en-us/articles/200170986-How-does-Cloudflare-handle-HTTP-Request-headers- https://support.cloudflare.com/hc/en-us/articles/200170986-H... For better or worse, this is how X-Forwarded-For works, by convention: each forwarder is supposed to append a value. This means that, even in a correct implementation, an attacker can specify an arbitrary prefix of values. The consumer must be very careful about which part of the chain they trust. But the report here seems to be suggesting that we're mishandling this appending in some cases. We're investigating and if true will fix ASAP. Because X-Forwarded-For is surprisingly complicated, we recommend using CF-Connecting-IP instead. As the docs say: "To restore original visitor IP addresses at your origin web server, Cloudflare recommends your logs or applications look at CF-Connecting-IP or True-Client-IP instead of X-Forwarded-For since CF-Connecting-IP and True-Client-IP have a consistent format containing only one IP."

From the article: > X-FORWARDED-FOR: 1.2.3.4 (yes, we can override this header with whatever we want !) Why aren't you guys disallowing that field from having any external value?

modoc 6y ago

Because it's legitimate to have values before the request gets to CloudFlare, for instance if it was routed out through a corporate proxy, etc..

MuffinFlavored 6y ago
Ouch. I wonder if it's time to cryptographically sign those values or add a checksum or something.
- acdha 6y ago
  Basically this is why you want to go full zero trust: if you use mutual authentication over TLS, this becomes much less of a concern since you’re not trying to craft policies based on IP addresses with multiple intermediaries.
ec109685 6y ago
Only possible if non-TLS or the company is man in the middling TLS (and certificate pinning isn’t enabled).
- allending 6y ago
  So... completely possible then.

kentonv 6y ago

So we're supposed to be appending the client's IP to whatever the client sent for X-Forwarded-For, documented here: https://support.cloudflare.com/hc/en-us/articles/200170986-How-does-Cloudflare-handle-HTTP-Request-headers- https://support.cloudflare.com/hc/en-us/articles/200170986-H... For better or worse, this is how X-Forwarded-For works, by convention: each forwarder is supposed to append a value. This means that, even in a correct implementation, an attacker can specify an arbitrary prefix of values. The consumer must be very careful about which part of the chain they trust. But the report here seems to be suggesting that we're mishandling this appending in some cases. We're investigating and if true will fix ASAP. Because X-Forwarded-For is surprisingly complicated, we recommend using CF-Connecting-IP instead. As the docs say: "To restore original visitor IP addresses at your origin web server, Cloudflare recommends your logs or applications look at CF-Connecting-IP or True-Client-IP instead of X-Forwarded-For since CF-Connecting-IP and True-Client-IP have a consistent format containing only one IP."