Forum Discussion

Bhupender_33575's avatar
Bhupender_33575
Icon for Nimbostratus rankNimbostratus
Oct 06, 2017

x-forwarded-for header value not getting added if it is allready present

Hi All,

 

I am facing issue with x-forwarded-for header. if i pass some dummy value to it. it doesn't get updated by BIG_IP. But if i dont send any value to it. i get the header populated with the correct proxy server IP.

 

Thanks bhupender

 

ASM Advanced WAF
security
  • THi's avatar
    THi
    Icon for Nimbostratus rankNimbostratus
    Oct 06, 2017

    If you are using HTTP profile to add the X-Forwarded-For header, it will append another instance of the header instead of replacing, as it seems to use header insert mechanism. If you want to replace the single existing one, use an iRule with HTTP::header replace command. It will replace last instance or create a new if none exist in the request.

     

    See: K4816: Using the X-Forwarded-For HTTP header to preserve the original client IP address for traffic translated by a SNAT

     

    "Note: Many servers and applications expect only a single X-Forwarded-For header, per request. However, the BIG-IP system appends a new X-Forwarded-For header to the existing set of HTTP headers, even if there is an existing X-Forwarded-For header in the request. Both approaches are valid according to the Internet Engineering Task Force (RFC2616, Section 4.2). For applications expecting a single X-Forwarded-For header, it is possible to use an iRule instead of the HTTP profile option to append the client IP value to the end of any existing X-Forwarded-For header. F5 DevCentral iRules codeshare contains an example of such an iRule: X Forwarded For Single Header Insert. A DevCentral login is required to access this content."