99 questions
0
votes
0
answers
16
views
How to print X-forwarded-for header value in Spring boot-3.3.5 using logback-spring.xml
we recently migrated our spring boot code from version 2.1.11.RELEASE to 3.3.5, previously when using 2.1.11.RELEASE we were able to print the X-Forwarded-For header value in log using spring-cloud-...
- 141
0
votes
2
answers
36
views
How can I retrieve the full list of IP addresses from the X-Forwarded-For header in Spring?
I'm working with Spring (Spring Web) and trying to determine the full chain of client IP addresses from a request. The code I'm using is based on Spring's ForwardedHeaderUtils. Currently, it only ...
- 798
3
votes
1
answer
430
views
How to change Nginx to deny by default instead of allow, when using X-Forwarded-For, with visitors inside the LAN allowed access without a login?
In an Nginx config we have the following code to allow viewing the site from inside the LAN without a login, otherwise require a login if outside the LAN:
real_ip_header X-Forwarded-For;
# IPs trusted ...
- 20.8k
1
vote
1
answer
588
views
Unable to modify externalTrafficPolicy
I need to preserve source IPs until they reach my destination containers (X-Forwarded-For headers); on web, the solutions/suggestions are leading me to that it's to change externalTrafficPolicy to '...
- 13
0
votes
0
answers
46
views
Is it Secure to Authenticate Solely Based on Spring Security's hasIpAddress Configuration?
I have some concerns regarding the authentication process solely relying on the hasIpAddress configuration in Spring Security. When I configure the X-Forwarded-For header in both Tomcat and Undertow, ...
1
vote
1
answer
2k
views
x-forwarded-for header missing in http request while it going through AWS LoadBalancer to spring boot application
I have spring boot application. Running this spring boot application behind proxy i.e AWS Loadbalancer.
In that there is one endpoint
@GetMapping(value = "/test", produces = MediaType....
0
votes
0
answers
228
views
X-FORWARDED-HOST Multiple Parameters Accepted?
I am working on a SOAP Web Service Issue. However I have a ambiguity if X-Forwarded-Host accepts multiple values like X-FORWARDED-HOST: www.example.com, www.example1.com
I've read the Apache ...
- 33
1
vote
0
answers
861
views
X-Forwarded-For header request replace
I'm making http requests in js for remote server which using amazon cloudfront. I know that cloudfront can add and replace X-Forwarded-For header name with my client ip and proxy, but can I make it ...
0
votes
1
answer
320
views
IIS: Manipulate X-Forwarded-for header
Is it possible to change the X-Forwarded-For header of incoming requests, so that only the rightmost IP address is kept?
Example:
173.8.159.11, 164.214.214.90
Becomes
164.214.214.90
- 389
1
vote
0
answers
108
views
Incorrect client IP with Django, Gunicorn, nginx
I've been trying to fix that issue for 5 hours using some possible solutions to the known problem, but it didnt occured.
I want to log (django logging extension) requests from client with saving ...
- 31
2
votes
0
answers
658
views
Do not forward X-Forwarded-For header when set by non-trusted IP
I am using a Kong Ingress Controller to route the traffic to my cloud services. One of these services (Keycloak) uses the value of X-Forwarded-For for some of its functionalities. Currently, if an ...
1
vote
0
answers
417
views
How to get user's IP address using Amazon API Gateway and FastAPI?
I am using Amazon API Gateway that forwards requests to a FastAPI server (I am not using nginx). I am trying to get the user's IP address in a FastAPI endpoint, but it does not seem to be working (...
- 1,134
-1
votes
1
answer
1k
views
vite/http-proxy "x-forwarded-*" issue (remove IPv6 part)
I develop a vue application, which use vite as bundler. It comes with a http server and the http-proxy middleware: https://vitejs.dev/config/server-options.html#server-proxy & https://github.com/...
- 3,876
0
votes
1
answer
415
views
IP, XSS, Cross-Site-Scripting, x-forwarded-for
I have applied filter in code to block the IP Address of user that try to cross-site-scripting attack on my website.
but issue is this here some IP Address come in text format Like below example, what ...
- 1
0
votes
1
answer
1k
views
Request.headers missing or undefined
Hopefully somebody will find this a relatively simple answer, but it is beyond me at the moment. I have a Node.js/Express setup. I am simply trying to retrieve the client IP address upon each ...
- 664
0
votes
1
answer
793
views
Regular Expression for X-Forwarded-For Values
I'm working on a regular expression that needs to validate the values of an incoming requests' x-forwarded-for header. The regex needs to validate both ipV4 and ipV6 address. Below are possible ...
- 62
0
votes
0
answers
899
views
Rewrite X-Forwarded-For header to remove port
I am running a Crowd/Confluence server behind Azure App Gateway LB. When making request to my crowd server, Azure is forwarding IP:PORT for the X-Forwarded-For in the header. There is an issue in ...
0
votes
1
answer
617
views
Get user ip when my service is behind multiple proxies and WAF
I deployed an ASP.NET Core web application using kubernetes and ran WAF server to manage the incoming request and protect our service.
I had a part of code that gets the IP of the end user and store ...
- 3,982
3
votes
3
answers
14k
views
How to set remote_addr to the real client IP? [duplicate]
I have the following nginx.conf and in the access.log I am getting the same IP for every request in remote_addr, which is the IP of my VM.
events{}
# See blow link for Creating NGINX Plus and NGINX ...
- 428
4
votes
0
answers
869
views
Can't get client's real IP when using Nginx in Docker
I have configured Nginx reverse proxy with Docker in my project.
part of my docker-compose file:
version: "3"
# optional ports are specified throughout for more advanced use cases.
...
- 105
-1
votes
1
answer
2k
views
Can I remove X-Forwarded-* headers from NodeJS https requests?
I have a NodeJS script I'm using to collect some web data, but the website I'm pulling from seems to have a strict no-proxy policy. Their API outright denies any requests with the X-Forwarded-For ...
- 199
0
votes
0
answers
959
views
How do I removed X-Powered-By Express from Angula App hosted on Azure App Service
I have an angular app deployed to azure app service. it returns two X-Powered-By as part of its response headers as below
X-Powered-By: ASP.NET
X-Powered-By: Express
I want both removed. I modified ...
- 11
1
vote
1
answer
593
views
X-Forwarded-Host header of OracleCloud LoadBalancer adds port alongwith the host. Is this correct?
As per my understanding, whenever there is a forward proxy or loadbalancer in the network, it must keep only the Host part in it. But the LoadBalancer used in OracleCloudInfrastrcture is adding both ...
0
votes
1
answer
500
views
Lua sample-fetch 'routeIP': runtime error: /etc/haproxy/route_req.lua:3: attempt to call a nil value (method 'fhdr') from /etc/haproxy/route_req.lua
I was trying to print my 'X-forwarded-for' header using LUA script in HAProxy. But I am getting error
/var/log/haproxy.log
May 18 18:37:06 ubuntu-s-1vcpu-1gb-blr1-01 haproxy[161927]: [ALERT] 137/...
- 7,761
1
vote
1
answer
907
views
How do I rewrite the app's base URL in spring-data-rest links?
My company uses an API gateway that transforms URLs as follows, modifying both the hostname and the base path of the resource:
https://apigateway.mycompany.com/myapp/foo -> https://myapp.mycompany....
- 7,709
6
votes
1
answer
7k
views
Identifying client IP from AWS ALB's X-Forwarded-For header while avoiding spoofing
According to AWS' documentation on the ALB and the X-Forwarded-For header, the client IP is the left-most (so proxies would follow on the right):
The left-most address is the client IP address where ...
- 408
0
votes
1
answer
2k
views
How can I display the headers sent in the request that results in an NGINX error page?
I have set a custom location (with a minimal HTML file) for the error page in my Nginx location block. The function `location is:
location / {
#try_files $uri $uri/ =404;
proxy_set_header X-...
- 3
0
votes
1
answer
1k
views
ForwardedHeaderFilter no longer support IPv6
After upgrading spring boot version to 2.4.9, the spring boot application works fine only for ipv4 but throws an error for ipv6. The app is deployed on google cloud run service. Current versions:
...
- 115
0
votes
0
answers
452
views
Traefik, EKS, TLS Termination, X-Forwarded-For
Deploying Traefik on EKS cluster. Need to terminate the TLS session using the ALB and also pass the X-Forwarded-For header. Running Traefik v2.4.8 using official helm chart ( traefik/traefik from ...
- 890
1
vote
2
answers
3k
views
AWS ELB Apache Get Client IP, Avoid X-Forwarded-For Spoofing
From apache docs (https://httpd.apace.org/docs/2.4/mod/mod_remoteip.html) we implemented the following assignment on our server:
RemoteIPHeader X-Forwarded-For
to get a client's IP rather than the ...
- 5,224
2
votes
1
answer
901
views
Azure Function X-FORWARDED-FOR Header format IPV6?
What is the format of the X-FORWARDED-FOR header of an HTTP-triggered Azure Function, when client makes request from an IPV6 endpoint?
IPV4 headers come across as...
111.222.333.444:<port#>
I'...
- 1,947
1
vote
3
answers
4k
views
How do I obtain Client IP address in .net-core instead of the load balancers? (using X-Forwarded-For)
I'm simply trying to get the Client IP address in a .net-core controller after they POST. We have a load balancer between the client and the server.
The setup in my startup:
services....
- 75
2
votes
1
answer
15k
views
Does cloudflare cf-connecting-ip affect http header?
I have a few questions about cloudflare service before I use it.
Are there any difference on http request header between a web server use cf-connecting-ip,x-forwarded-for etc and a web don't use ...
- 61
0
votes
1
answer
1k
views
enable X-Forwarded-for on oracle cloud private loadbalancer
the traffic is accepted at firewall then forwarded to private load-balancer on oracle cloud, the forwarded to internal web servers. the problem is that client IP address at we server is seen as load-...
1
vote
0
answers
648
views
double proxied request - get original ip
I have the following setup:
User makes a request, that goes to cloudflare, that acts as a proxy for the request, and redirects it to an aws network load balancer, that finally routes it to its ...
- 8,582
4
votes
1
answer
1k
views
no X-Forwarded-For with Traefik 2 on bare metal Kubernetes with ClusterIP Service and kube-keepalive-vip
My setup is a bare metal cluster running Kubernetes 1.17. I'm using Traefik 2(.3.2) as a reverse proxy and to get failover for my machines I use kube-keepalive-vip [1].
---
apiVersion: v1
kind: ...
- 1,135
0
votes
1
answer
547
views
Varnish: Multiple IPs compare to ACL using Tilde
What would happen in Varnish if multiple IPs are in an X-Forward-For header which is compared to an ACL using the tilde operator?
Dummy example:
The request has the following HTTP header:
X-Forward-...
- 1,085
0
votes
1
answer
2k
views
Kong :: Client IP missing in X-FORWARDED-FOR
Using Kong ingress controller (v2.1) in Kubernetes. Running in Digital Ocean.
The problem is that client IP is missing in X-FORWARDED-FOR header for HTTPS request, yet present on the HTTP request. I ...
- 890
2
votes
0
answers
678
views
Apache proxyPass with x-forwarded-for not working
I have an issue with Apache X-Forwarded-For.
Here is the scenario
I have a server which will forward the request to an Apache Server. And the Apache server has multiple Proxy forwards.
What the ...
2
votes
1
answer
4k
views
Is remote address the same as x-forwarded-for?
I need to get the x-forwarded-for header from requests. Since i already have an http filter, i can easily log remote address using HttpServletRequest.getRemoteAddr(), whereas logging x-forwarded-for ...
- 67
0
votes
1
answer
1k
views
Need to get remote ip of one who is accessing the web application
I am trying to log website visitor application in tomcat logs
I have tried adding below lines of code in server.xml
<Valve className="org.apache.catalina.valves.AccessLogValve" directory=&...
0
votes
2
answers
2k
views
How to select origin ip for X-Forwarded-For field using log parser studio?
I am trying to write a query that gets the first value of the X-Forwarded-For field. There is multiple IPs in that field due to load balancers. Is there any way just to get the first value, which is ...
- 821
0
votes
1
answer
478
views
AWS Api Gateway Lambda proxy integration, how to get source port from client request
I'm using AWS Api Gateway to invoke my Lambda functin in proxy mode. Event object contains X-Forwarded-Port information but it contains destination port of client request whereas I need the source ...
- 501
10
votes
1
answer
48k
views
What's the purpose of setting "X-Forwarded-For" header in nginx
I have the following Nginx configuration for my Django application:
upstream api {
server localhost:8000;
}
server {
listen 80;
location / {
proxy_pass http://api;
...
- 5,865
1
vote
0
answers
3k
views
how to set squid proxy server to get client real ip address
My clients http requests go through Squid proxy server to connect to backend apache web server. A php script in the backend webserver gets clients' real ip address as below:
if (!empty($...
- 11
0
votes
1
answer
2k
views
Apache httpd (mod_proxy) seems to drop/ignore 3rd IP address in X-Forwarded-For chain?
Consider the scenario/flow:
remote user (client) > proxy1 > proxy2 > AWS ALB > httpd/reverse_proxy > my_application
As user's request traverses out of their network, the X-Forwarded-...
- 1
4
votes
1
answer
4k
views
Tomcat: 'X-Forwarded-For' doesn't work with load balancer
We are currently working on a redundant server setup (2 servers + 1 load balancer) using Tomcat 7 update 76. To fulfill the logging requirements of our company, we are trying to get the IP of the ...
- 303
0
votes
0
answers
447
views
Nginx deny ip not working when I use ddos denfence server as frontend
I want add block IP address into nginx configure.But it still can be accessed using curl !
...
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
...
- 11
48
votes
6
answers
47k
views
How to configure nginx X-Forwarded-Port to be the originally request port
I am using nginx in a standard reverse proxy scenario, to pass all requests to /auth to another host, however I'm trying to use non-standard ports.
My end goal is to have the X-Forwarded-Port header ...
- 4,423
56
votes
11
answers
78k
views
FastAPI (starlette) get client real IP
I have an API on FastAPI and i need to get the client real IP address when he request my page.
I'm ty to use starlette Request. But it returns my server IP, not client remote IP.
My code:
@app.post(...
- 821