4 ms·
Hmm... I've worked on software at three different orgs that rely on the X-Forwarded-For header to identify a client's IP address from in front of a firewall (I'
by drsim 14y ago
Hmm... I've worked on software at three different orgs that rely on the X-Forwarded-For header to identify a client's IP address from in front of a firewall (I'm not a network guy, but I think it was Cisco equipment).
I agree the X- prefix ain't great. Is there an alternative for the originating IP address? If not, we need one.
- apgwoz 14y agoWell, I guess their hope is that people start using Forwarded-For, and then it becomes standardized in the same way that X-Forwarded-For has sort of become standard.
- drsim 14y agoThanks. Draft here: http://tools.ietf.org/html/draft-ietf-appsawg-http-forwarded-04 http://tools.ietf.org/html/draft-ietf-appsawg-http-forwarded...
- Jare 14y agoI think the relevant portions are: > 1. Deprecates the "X-" convention for newly defined parameters (emphasis mine) > 4. Makes no recommendation as to whether existing "X-" parameters ought to remain in use or be migrated to a format without the "X-"; this is a matter for the creators or maintainers of those parameters. In practice, I expect X-Forwarded-For to live long and prosper for many years even if a X-less version standardizes.