For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

cjbarr1234's avatar
cjbarr1234
Icon for Altostratus rankAltostratus
May 31, 2016

iRule Remove Pre-Existing X-Forward-For

Hello,   We have a few clients that are injecting X-Forward-for into the client request. The LTM I am managing also Adds on X-Forward-For via source address, so it is duplicating the source addre...
application delivery
iRules
LTM
Walter_Kacynski's avatar
Walter_Kacynski
Icon for Cirrostratus rankCirrostratus
May 31, 2016

You should be able to use this iRule:

when HTTP_REQUEST {
     The header must first be removed so that a remote user is not able to spoof this value.
    HTTP::header remove X-Forwarded-For
}

At my site however, I have stopped using X-Forwarded-For and made up my own HTTP Header with this information like X-Custom-ClientIP, this prevents any intermediaries from messing with X-Forwarded-For and losing or changing information.