Forum Discussion
Bubbagump_12531
Nimbostratus
NimbostratusPrevent X-Forwarded-For spoofing
We insert an X-Forwarded-For header to pass back to our web servers. One application we have looks to this header to allow or deny certain servers access to us. However, we want to prevent spoofing t...
Kevin_Stewart
Employee
EmployeeTry this:
when HTTP_REQUEST {
set xff 0
foreach x [HTTP::header names] {
if { [string tolower $x] equals "x-forwarded-for" } {
set xff 1
HTTP::header remove $x
HTTP::header insert X-FORWARDED-FOR [IP::client_addr]
}
}
if { $xff == 0 } {
HTTP::header insert X-FORWARDED-FOR [IP::client_addr]
}
}
