Let's assume that an HTTP server (which hosts the endpoint for some REST API, say) is configured to allow connections only from a single client (let's call it 1st client), i.e. from a single client IP address. If that client would run an HTTP proxy such as squid and if another client (let's call it 2nd client) would connect through that proxy e.g. like so

<2nd-client>$ curl -x <1st-client> --cacart <cert> https://server

would the HTTP server then see the 1st or 2nd client's IP address as where the HTTP(S) request originated from? In other words, could other clients circumvent the access restricion imposed on client IP addresses by going through that proxy?

  • 3
    Of course the server would see a PROXY IP as a client IP, unless the proxy will be configured to use the x-forwarder-for header in the requests, and the end server will respect those headers and pass them for example to a PHP script (or another language for that matter) That way even when using a PROXY the end application will be able to recognize the IP that the request was really originating from. – bocian85 Sep 19 '17 at 12:55

I believe that depends on how the proxy server is configured. If its not a proxy you control then the answer would be yes a client could potentially circumvent an ACL.

If you do control the proxy you can set the XFF (X-Forwarded-For) header and set your server to read the IP from that header.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.