Forum Discussion
Bubbagump_12531
Nimbostratus
NimbostratusPrevent X-Forwarded-For spoofing
We insert an X-Forwarded-For header to pass back to our web servers. One application we have looks to this header to allow or deny certain servers access to us. However, we want to prevent spoofing t...
Bubbagump_12531Nimbostratus
NimbostratusRight, but won't the HTTP policy then also put on an addition X-Forwarded-For header? My thought is an iRule to do it all.
Basic logic now:
If a header exists coming in, remove and create your own.
THEN
HTTP policy adds another header.
I am thinking a single rule that works like:
If a header exists coming in, remove and create your own. Else if no header, create your own.
THEN
HTTP policy does nothing regarding XFF headers.
