What can I use in the nginx config to make it clear any existing X-Forwarded-For headers before setting its own? I am currently using Nginx to terminate SSL before passing traffic to HAProxy to load balance.
Right now, I have:
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
This will append a new IP address to the end of any existing X-Forwarded-For IP addresses however. Is there a way to only keep the address seen by Nginx?
Just don't use $proxy_add_x_forwarded_for - the whole purpose that it exists is to do the appending behavior.
Instead:
proxy_set_header X-Forwarded-For $remote_addr;
X-Forwarded-For header is to contain the IP of the original client, plus the IP of the proxy server. From what I understand, setting it to $remote_addr will indeed remove any existing entries in the header, and keep the original client IP, but not add the proxy server IP. Is there a way to do both? Clear any existing entires, add the client IP, and add the proxy server IP? If you have multiple reverse proxies chained together, you could use this on the first one, and use $proxy_add_x_forwarded_for on all others.
$proxy_add_x_forwarded_for is not adding its own IP to the XFF list - it's adding the source IP it got the request from to the XFF list. In that case, setting the XFF header to $remote_addr makes sense. If you do have a chain of reverse proxies that follow, having the rest use $proxy_add_x_forwarded_for will work as expected. Thanks for the clarification
If anyone still have this issue, you can make use of "more_clear_input_headers" to keep only the address of last hop seen by Nginx.
more_clear_input_headers "X-Forwarded-For";
see the docs from openresty: https://github.com/openresty/headers-more-nginx-module#more_clear_input_headers
