I have the following httpd.conf file which I am using to test X-Forwarded-For header IP whitelisting. Note that the conf.d directory is empty:

Include conf.modules.d/*.conf
ServerRoot "/etc/httpd"
Listen 80
Listen 443

User dev
Group dev
ServerAdmin root@localhost
ServerName my-httpd-server

<Directory />
AllowOverride none
Require all denied

<Files ".ht*">
Require all denied

<IfModule mime_module>
TypesConfig /etc/mime.types
AddType application/x-compress .Z
AddType application/x-gzip .gz .tgz

AddType text/html .shtml
AddOutputFilter INCLUDES .shtml

AddDefaultCharset UTF-8

<IfModule mime_magic_module>
MIMEMagicFile conf/magic

EnableSendfile on

DocumentRoot "/var/www/html"

<Directory "/var/www">
    AllowOverride None
    Require all granted

<Directory "/var/www/html">
    Options -Indexes +FollowSymLinks
    AllowOverride None
    LogLevel debug
    Order deny,allow
    Deny from all
    #Satisfy any

    SetEnvIf X-Forwarded-For ^ letmein

    Allow from env=letmein

     Satisfy any

IncludeOptional conf.d/*.conf

When I cURL to get the local page with this server, it works regardless of the XFF header:

curl -H 'X-Forwarded-For:' http://localhost

curl http://localhost

These work, but print the following in the error log (These requests should not work):

[Mon Dec 17 10:24:53.346021 2018] [access_compat:error] [pid 12] [client] AH01797: client denied by server configuration: /var/www/html/
[Mon Dec 17 10:24:53.346614 2018] [authz_core:debug] [pid 12] mod_authz_core.c(809): [client] AH01626: authorization result of Require all granted: granted
[Mon Dec 17 10:24:53.347603 2018] [authz_core:debug] [pid 12] mod_authz_core.c(809): [client] AH01626: authorization result of <RequireAny>: granted

The following request from the whitelisted IP works but without the logging noise:

curl -H 'X-Forwarded-For:' http://localhost:8181/

What is causing the requests that should fail to return the web page? I get the message that it should be denied based on the config?


I think you need the satisfy any bit to be changed to satisfy all. That refers to allowing a user if they meet the authentication OR access requirements. Since I don't see an authtype set, it's defaulted to AuthType none which I think allows them to pass in. satisfy all means Authentication AND Access are required to be met.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.