option forwardfor #46
-
|
Hey guys, one of the developers of Authelia here. We have had a user report that the XFF header is not appearing when using this module and |
Beta Was this translation helpful? Give feedback.
Replies: 2 comments 4 replies
-
Without testing: It should be possible to |
Beta Was this translation helpful? Give feedback.
-
|
Yep this is probably what we'll update our guide to suggest, as well as an ACL checking if it exists (in which case leaving it alone and using option forwardfor). |
Beta Was this translation helpful? Give feedback.
-
Not sure if I read that right, but blindly trusting (or suggesting to trust) an existing XFF header might open up the setup to security issues. That's why you need to explicitly add the
|
Beta Was this translation helpful? Give feedback.
-
|
I'm also aware of this but I appreciate you pointing it out, we don't have an example of removing that yet but it's something that I had planned implementing in all proxy examples via utilizing a file ACL (works well for Cloudflare for example, which also can't be trusted unless you configure a transform rule correctly). We are going to have to do a mix of ACL's to get this operating safely and in a way that's reliable. |
Beta Was this translation helpful? Give feedback.
-
|
Yes, i confirm this fixes my issue, i put this under the frontend https_front that i was using and i started getting the XFF header. |
Beta Was this translation helpful? Give feedback.
-
|
Great this is also the solution we roughly came up with privately in testing. Keep an eye out though because I will be making a significant change to the docs which hopefully addresses this in a more comprehensive yet secure way. |
Beta Was this translation helpful? Give feedback.
Without testing: It should be possible to
http-request set-header x-forwarded-for %[src]before calling haproxy-auth-request. That line should be equivalent for a simpleoption forwardforwithout any other parameters.