4 ms·
Most load balancers will silently drop the real IP address header on the ingress side to avoid exactly what you are describing. That used to be a thing around
by Bender 3mo ago
Most load balancers will silently drop the real IP address header on the ingress side to avoid exactly what you are describing. That used to be a thing around 2000 - 2001 era. If you find a load balancer with that issue today open a case with their vendor.
- inigyou 3mo agoNot reliably enough. Look for parser differentials.
- 63stack 3mo agoPlease enlighten us
- inigyou 3mo agoDifferences in parsing between two systems can allow data to sneak through. For example you might put a space before the header name. The reverse proxy might treat it as a header name starting with a space, so not matching the one it wants to remove, and not removed, while the origin server trims the space. This is a ubiquitous security concern, like IDOR and memory safety. Every time you have a separate validation step for anything, you have the possibility of a parser differential vulnerability. If you don't know it yet, look up "HTTP request smuggling" - pretty interesting.