Questions tagged [x-forwarded-for]
HTTP header field for identifying the origin IP address
25
questions with no upvoted or accepted answers
2
votes
0
answers
181
views
Stop a user from circumventing IP block?
A user is somehow avoiding an IP block in apache 2.2/2.4, and I can not figure out how. The company I work for hosts hundreds of sites in different datacenters; this user is attacking several of the ...
- 21
2
votes
0
answers
222
views
HAProxy, why would a replaced HTTP header have a number at the end?
Can someone explain what the "X-Forwarded-Proto2" header is in this HAProxy frontend stanza?:
frontend main *:443
...
reqirep ^(X-Forwarded-Proto:)(.*) X-Forwarded-Proto2:\2
...
I understand ...
- 377
2
votes
0
answers
8k
views
Apache proxy server not passing X-Forwarded-For
I am migrating some sites from one server to another. To avoid any downtime, I am proxying moved sites through the old server while the DNS updates.
On the original (proxy) server, I have the ...
- 153
2
votes
1
answer
1k
views
Nginx not getting the real visitor IP in server block
I am using a loadbalancer in my current setup, requests come from ip 10.71.128.13.
I am using Nginx as a front to a Gunicorn backend. I want to get the real IP address of the visitor and log it (not ...
- 141
1
vote
0
answers
539
views
Apache's remoteip module does not populate the client_ip
In an intranet environment, I have a relatively involved scenario, all on the same server:
IIS server acting as a reverse proxy listening on 443
forwards matching requests to localhost:1080/redmine
...
- 211
1
vote
0
answers
155
views
"proxy_set_header Upgrade" causes "real_ip_header" not working
nginx config:
map $http_upgrade $connection_upgrade {
default keep-alive;
'websocket' upgrade;
}
set_real_ip_from 127.0.0.1;
set_real_ip_from 192.168.203.1;
real_ip_recursive on;
real_ip_header X-...
- 11
1
vote
1
answer
3k
views
Apache won't record X-Forwarded-For
I am trying to record the a client ip stored in the X-Forwarded-For http header in the Apache access logs but having no luck and have been pulling my hair out for hours. I've tried a ton of different ...
- 619
1
vote
0
answers
27
views
Does in-the-field experience suggest that a HTTP POST is more reliable than PUT and DELETE
I need to cross reference my experience with that of professionals, as I'm developing a REST application that can either
Use on HTTP POST for all delete and create operations
Or use HTTP DELETE and ...
- 8,951
1
vote
0
answers
219
views
Correct log format dependent on route
I have a few virtual hosts running on a server, a couple are through a CDN and have X-Forward-For added to the headesr, sometimes it just goes through a load balancer where RemoteIPHeader is added.
I ...
- 191
1
vote
0
answers
2k
views
Apache 2.4 X-Forwarded-For for remoteip
I configured apache 2.4 with following file
/etc/apache2/conf-available/remoteip.conf
RemoteIPHeader X-Forwarded-For
RemoteIPTrustedProxy 127.0.0.1
But It will not include header in tomcat.
...
- 111
1
vote
0
answers
235
views
Restore original visitor IP for static site on AWS S3 using Cloudflare
I've a static site on S3, with cloudflare as my DNS provider. The server logs are collected in an S3 bucket. However the visitor IP address in the log files points to cloudflare servers instead of the ...
- 111
1
vote
1
answer
708
views
Allowing multiple IPs behind ELB in Apache configuration
I have multiple application servers running as EC2 instances. Only certain bare-metal servers running elsewhere are allowed to contact them and their IPs whitelisted explicitly in the httpd.conf @the ...
1
vote
0
answers
421
views
ELB allows unencrypted/http communication on port 443?
I was testing a configuration of AWS ELB to use for SSL termination when I came across an intermittent issue...
Ocasionally, you can specify HTTP with port 443 (http://...:443) and ELB will pass ...
- 111
1
vote
1
answer
2k
views
X-forwarded-for NULL in Tomcat
We are injecting the x-forwarded-for header in the loadbalancer, which sends the request to apache web server, which inturn proxys (mod_proxy_balancer) the request to the backend tomcat server.
we are ...
- 53
0
votes
0
answers
92
views
IIS rewrite rule to modify IP format in X-Forwarded-For header
I'm using IIS as a reverse proxy and I've found that by default, when using the built in method to have IIS add the client IP into the X-Forwarded-For header, if the client IP is IPv6 it will encase ...
- 1
0
votes
0
answers
608
views
How do I correctly configure Nginx XFF?
I am trying to follow the directions found here:
https://nginx.org/en/docs/http/ngx_http_realip_module.html
and referenced here:
https://www.loadbalancer.org/blog/nginx-and-x-forwarded-for-header/
...
- 101
0
votes
0
answers
81
views
Who sets the X-Forwarded-For hader?
Let's say I make an https GET request to a webserver with curl without specifying any headers.
On the webserver, I see the incoming request has a X-Forwarded-For (XFF) header set. Given that I did not ...
- 125
0
votes
0
answers
282
views
Can't get Public IP of Inbound Connections from Behind NAT + Reverse Proxies
My network flow looks like this:
Public Client
∟--> CDN Reverse Proxy (Cloudflare) - ONLY used for HTTP/S traffic, all else goes direct
∟--> Cloud Server w/ firewalld forwarding
...
- 31
0
votes
0
answers
157
views
HaProxy X-Forwered-For sends when already present incoming request
I'm trying to get X-Forwarded-For when original client request contains that header and pass it to the application layer in using HAProxy.
any help will be appreciated.
0
votes
1
answer
3k
views
Can squid add X-Forworded-For header in https request?
I know squid can perform as a mitm,so I want to know can squid add X-Forworded-For header in https request?
If can add, how to configure it?
- 21
0
votes
1
answer
1k
views
how to block external request coming from proxy server to nginx webserver
I have web application hosted in nginx web server. I would like to disable request from any proxy server to my webserver (nginx) .
I need to return 403 for those who request via proxy server.
Is ...
0
votes
1
answer
310
views
Get client IP from Web application via Load-Balancer alternative
If a Web application server (ex. nginx&php-fpm) is behind Load-Balancer such as AWS-ELB:
Client -> Load-Balancer -> Web Application server
To get the real client IP from Web application ...
- 1,338
0
votes
1
answer
97
views
AWS forward request between private instances
I have a public subnet holding AWS ELB which forward its requests to a private EC2 instance.
Is there a way I can forward the request from my private EC2 request to another private EC2 instance?
In ...
- 175
0
votes
1
answer
3k
views
How to access X-Forwarded-For header on HAProxy behind AWS Loadbalancer
On HAProxy instances running on K8S I need to block certain IP addresses manually on HAProxy. Currently I am failing already to log them. Per the AWS docs the loadbalancers set the X-Forwarded-For ...
- 85
-1
votes
1
answer
2k
views
How to implement X-Forwarded-For to see header in web page
I am wanting to implement X-Forwarded-For so that when a user visits a site the actual IP is registered. So far I have added the following to my apache.conf file on my load balancer:
LogFormat "%h %l ...
- 121