I know, that I can turn off X-Forwarded-For header in Squid completley by using directive "forwarded_for off" or "forwarded_for delete" globally. I would like to be able to disable that header only for specific ACLs, so I can disable this header only for given URLs and have it enabled for others. Is there any way to do that?
2 Answers
You can create an ACL based on an external file to store URLs (easier to manage in my opinion) :
acl NoXForwardedFor dstdomain "/etc/squid/NoXForwardedFor.txt"
The content of /etc/squid/NoXForwardedFor.txt
would be something like this :
.serverfault.com
.superuser.com
.stackoverflow.com
Then remove X-Forwarded-From
from the header for the given ACL :
request_header_access X-Forwarded-For deny NoXForwardedFor
Note : You can use the dst
directive instead of the dstdomain
directive.
But it requires URL host's IP address, so make sure the target domain has
fixed ip address(es).
Maybe some useful links for deeper understanding :
-
Thank you very much, but from what I know - maybe I am wrong - this is not the same thing, as removing the X-Forwarded-For header completly. This just stops parsing of the value of that header to track the original location. My use case is different - I want to get rid of the header completly (remove it from the request that goes from squid to the website), but only for specific domains.– dotzFeb 6, 2014 at 8:43
-
-
Thanks a million, the second approach works. Please edit your reply so it includes only the second approach (as the first one simply does not do what I wanted) and I'll accept it as an answer. THANKS!– dotzFeb 7, 2014 at 7:02
-
-
I tried the same and the correct syntax is
acl NoXForwardedFor dst "/usr/pbi/squid-amd64/etc/squid/NoXForwardedFor.txt"
request_header_access X-Forwarded-For deny NoXForwardedFor
where NoXForwardedFor.txt
contains domain names.