1

I know, that I can turn off X-Forwarded-For header in Squid completley by using directive "forwarded_for off" or "forwarded_for delete" globally. I would like to be able to disable that header only for specific ACLs, so I can disable this header only for given URLs and have it enabled for others. Is there any way to do that?

0

You can create an ACL based on an external file to store URLs (easier to manage in my opinion) :

acl NoXForwardedFor dstdomain "/etc/squid/NoXForwardedFor.txt"

The content of /etc/squid/NoXForwardedFor.txt would be something like this :

.serverfault.com
.superuser.com
.stackoverflow.com

Then remove X-Forwarded-From from the header for the given ACL :

request_header_access X-Forwarded-For deny NoXForwardedFor

Note : You can use the dst directive instead of the dstdomain directive. But it requires URL host's IP address, so make sure the target domain has fixed ip address(es).

Maybe some useful links for deeper understanding :

| improve this answer | |
  • Thank you very much, but from what I know - maybe I am wrong - this is not the same thing, as removing the X-Forwarded-For header completly. This just stops parsing of the value of that header to track the original location. My use case is different - I want to get rid of the header completly (remove it from the request that goes from squid to the website), but only for specific domains. – dotz Feb 6 '14 at 8:43
  • @dotz I have edited my answer. Give it a try ! – krisFR Feb 6 '14 at 9:06
  • Thanks a million, the second approach works. Please edit your reply so it includes only the second approach (as the first one simply does not do what I wanted) and I'll accept it as an answer. THANKS! – dotz Feb 7 '14 at 7:02
  • @dotz You are welcome, glad it works ! Ok, edited. – krisFR Feb 7 '14 at 8:15
  • Thank you for your assistance and a great contribution to serverfault. – dotz Feb 7 '14 at 11:39
-1

I tried the same and the correct syntax is

acl NoXForwardedFor dst "/usr/pbi/squid-amd64/etc/squid/NoXForwardedFor.txt"

request_header_access X-Forwarded-For deny NoXForwardedFor

where NoXForwardedFor.txt contains domain names.

| improve this answer | |
  • This doesn't seem to add anything compared to the accepted answer. – Kenster Jun 13 '14 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.