irule to reject user defined headers

Hi

Understood. So the iRule I send should do the trick. You could also do the same thing with an LTM Policy if you prefer.

With this iRule :

• Any header received on the public part is removed
• F5 takes the Client IP address, and inserts the X-Forwarded-For header himself (hence the client cannot manipulate the values, and send injections...)

The if the external users goes through a proxy, of course, the client IP address will be the proxy IP, not the real client IP behind the proxy. Is that enough ?

If not, then you will need to allow the header and check it's value...

Yoann