3 ms·
That was one of the most comprehensive posts I read on this topic, well done. One addition I'd suggest is to add going into the implications of enabling "clien
by nickjj 5y ago
That was one of the most comprehensive posts I read on this topic, well done.
One addition I'd suggest is to add going into the implications of enabling "client port preservation" with an AWS ALB. This can be a death sentence if you decide to turn it on without intimate knowledge on how all connected apps are trying to figure out the real IP. It appends the client port to the IP with a colon in X-Forwarded-For and if you happen to read IPs without expecting this then it can potentially cause IP values to appear invalid. It's super app dependent on what would happen but it has a lot of side effect potential.
- kingforaday 5y agoI also would like to express my appreciation for the post and hope the Author will see this comment. Thanks!
- iancarroll 5y agoParsing this header is such a nightmare. HAProxy had a CVE a while ago where they stopped parsing the header if they hit a quote in the middle, which allowed you to forge the right-most IP. As a result I had a long conversation with AWS where I told them it was ridiculous that ALBs allowed garbage to be inserted in the only header that contains this important information… suffice to say they did not care.
- adam-p 5y agoI didn't know about that option. Here's a link for anyone who wants details: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/x-forwarded-headers.html https://docs.aws.amazon.com/elasticloadbalancing/latest/appl... That's pretty bad. It makes the already perilous header even worse. I'll a note or addendum about it in the post when I get a chance. (@kingforaday: You're welcome!)