4 ms·

This seems like a vulnerability in their implementation: "configure your proxy to set the X-Forwarded-For header with the source IP"

• rrouse 13y ago
  That's pretty common practice so you don't get the IP of the machine your web server is on passed to the app instead of the user's ip.
• mh- 13y ago
  if you're behind a reverse proxy (or load balancer, etc.) one should normally have [firewall] rules to ensure that only these proxy hosts can even connect to your httpd. you also can configure your edge proxies to ignore X-Forwarded-For, or at least move it to another untrusted header if you want to preserve its contents. there's an nginx module (has to be compiled in) that lets you whitelist hosts which can send X-Forwarded-For, and turns that into the actual remote address provided to your upstreams. http://wiki.nginx.org/HttpRealipModule http://wiki.nginx.org/HttpRealipModule | http://nginx.org/en/docs/http/ngx_http_realip_module.html http://nginx.org/en/docs/http/ngx_http_realip_module.html