X-Forwarded-For: Difference between revisions
Rescuing 2 sources and tagging 0 as dead.) #IABot (v2.0.8) (AManWithNoPlan - 7487 |
m Disambiguating links to Anonymous web browsing (link changed to Private browsing) using DisamAssist. |
||
(17 intermediate revisions by 14 users not shown) | |||
Line 8: | Line 8: | ||
The <code>X-Forwarded-For</code> HTTP request header was introduced by the [[Squid (software)|Squid]] caching proxy server's developers.{{Citation needed|date=February 2020}} |
The <code>X-Forwarded-For</code> HTTP request header was introduced by the [[Squid (software)|Squid]] caching proxy server's developers.{{Citation needed|date=February 2020}} |
||
<code>X-Forwarded-For</code> is also an [[Email headers|email-header]] indicating that an email-message was [[Email forwarding|forwarded]] from one or more other accounts (probably automatically).<ref>{{Cite web |url=http://mailheader.mattiasgeniar.be/headers.php | |
<code>X-Forwarded-For</code> is also an [[Email headers|email-header]] indicating that an email-message was [[Email forwarding|forwarded]] from one or more other accounts (probably automatically).<ref>{{Cite web |title=Overview of parsed mail headers |url=http://mailheader.mattiasgeniar.be/headers.php |url-status=dead |archive-url=https://web.archive.org/web/20140920220804/http://mailheader.mattiasgeniar.be/headers.php |archive-date=2014-09-20 |access-date=2014-05-05}}</ref> |
||
⚫ | Without the use of XFF or another similar technique, any connection through the proxy would reveal only the originating IP address of the proxy server, effectively turning the proxy server into an [[Private browsing|anonymizing service]], thus making the detection and prevention of abusive accesses significantly harder than if the originating IP address were available. The usefulness of XFF depends on the proxy server truthfully reporting the original host's IP address; for this reason, effective use of XFF requires knowledge of which proxies are trustworthy, for instance by looking them up in a whitelist of servers whose maintainers can be trusted. |
||
In this context, the caching servers are most often those of large [[Internet service provider|ISPs]] who either encourage or force their users to use proxy servers for access to the [[World Wide Web]], something which is often done to reduce external bandwidth through caching. In some cases, these proxy servers are transparent proxies, and the user may be unaware that they are using them. |
|||
⚫ | Without the use of XFF or another similar technique, any connection through the proxy would reveal only the originating IP address of the proxy server, effectively turning the proxy server into an [[ |
||
==Format== |
==Format== |
||
Line 19: | Line 17: | ||
X-Forwarded-For: client, proxy1, proxy2 |
X-Forwarded-For: client, proxy1, proxy2 |
||
where the value is a comma+space separated list of IP addresses, the left-most being the original client, and each successive proxy that passed the request adding the IP address where it received the request from. In this example, the request passed through proxy1, proxy2, and then proxy3 (not shown in the header). proxy3 appears as remote address of the request. |
where the value is a comma+space separated list of IP addresses, the left-most being the original client, and each successive proxy that passed the request adding the IP address where it received the request from. In this example, the request passed through ''proxy1'', ''proxy2'', and then ''proxy3'' (not shown in the header). ''proxy3'' appears as remote address of the request. |
||
Examples:<ref>{{Cite web|title=X-Forwarded-For|url=https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For|access-date=2020-11-06|website=MDN Web Docs|language=en}}</ref> |
Examples:<ref>{{Cite web|title=X-Forwarded-For|url=https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For|access-date=2020-11-06|website=MDN Web Docs|language=en}}</ref> |
||
X-Forwarded-For: 203.0.113.195, 70.41.3.18, 150.172.238.178 |
|||
X-Forwarded-For: 203.0.113.195 |
|||
X-Forwarded-For: 2001:db8:85a3:8d3:1319:8a2e:370:7348 |
|||
Because the X-Forwarded-For header is not formally standardized, some variations to the IP address format exist. For example, some implementations{{Which|date=April 2023}} include the port number of clients, or enclose IPv6 addresses in square brackets even without the port number, similar to the format in the newer <code>Forwarded</code> header. Examples: |
|||
<pre> |
|||
X-Forwarded-For: 203.0.113.195, |
X-Forwarded-For: 203.0.113.195:41237, 198.51.100.100:38523 |
||
X-Forwarded-For: |
X-Forwarded-For: [2001:db8::1a2b:3c4d]:41237, 198.51.100.100:26321 |
||
X-Forwarded-For: 2001:db8: |
X-Forwarded-For: [2001:db8::aa:bb] |
||
</pre> |
|||
== Usage == |
|||
Since it is easy to forge an X-Forwarded-For field the given information should be used with care. The right-most IP address is always the IP address that connects to the last proxy, which means it is the most reliable source of information. X-Forwarded-For data can be used in a forward or reverse proxy scenario. |
|||
The X-Forwarded-For header is added or edited by HTTP [[proxy server|proxies]] when forwarding a request. The server appends the address of the client to an existing X-Forwarded-For header separated by a comma, or creates a new X-Forwarded-For header with the client address as the value. |
|||
Since it is easy to forge an X-Forwarded-For field the given information should be used with care. The right-most IP address is always the IP address that connects to the last proxy, which means it is the most reliable source of information. X-Forwarded-For data can be used in a forward or reverse proxy scenario. If the server is behind a trusted [[reverse proxy]] and only allows connections from that proxy, the header value can usually be assumed to be trustworthy. |
|||
Just logging the X-Forwarded-For field is not always enough as the last proxy IP address in a chain is not contained within the X-Forwarded-For field, it is in the actual IP header. A web server should log both the request's source IP address and the X-Forwarded-For field information for completeness. |
|||
==Proxy servers and caching engines== |
|||
{{importance section|date=March 2015}} |
|||
The X-Forwarded-For field is supported by most proxy servers, including [[A10 Networks]], [[aiScaler]],<ref>{{cite web|url=https://aiscaler.com/pdf/adminguide.pdf|title=Admin Guide Page 152|website=Aiscaler.com|access-date=12 November 2017}}</ref> |
|||
[[Squid (software)|Squid]],<ref>[http://wiki.squid-cache.org/SquidFaq/ConfiguringSquid#head-3518b69c63e221cc3cd7885415e365ffaf3dd27f SquidFaq/ConfiguringSquid – Squid Web Proxy Wiki]. Wiki.squid-cache.org (2012-02-06). Retrieved on 2012-12-24.</ref> |
|||
[[Apache HTTP Server|Apache]] mod_proxy,<ref>[http://httpd.apache.org/docs/trunk/mod/mod_proxy.html mod_proxy – Apache HTTP Server]. Httpd.apache.org. Retrieved on 2012-12-24.</ref> |
|||
[[Pound (networking)|Pound]],<ref>[http://www.apsis.ch/pound/ Pound proxy] {{Webarchive|url=https://web.archive.org/web/20150607055138/http://www.apsis.ch/pound/ |date=2015-06-07 }}, under "Request Logging"</ref> |
|||
[[HAProxy]],<ref>[http://haproxy.1wt.eu/download/1.4/doc/configuration.txt HAProxy Configuration Manual]. haproxy.1wt.eu. Retrieved on 2012-12-24.</ref><ref>[http://haproxy.1wt.eu/ haproxy.1wt.eu]. haproxy.1wt.eu. Retrieved on 2012-12-24.</ref> |
|||
[[Varnish cache|Varnish]],<ref>[http://varnish.projects.linpro.no/wiki/FAQ#HowcanIlogtheclientIPaddressonthebackend Varnish FAQ] {{webarchive |url=https://web.archive.org/web/20080329064413/http://varnish.projects.linpro.no/wiki/FAQ#HowcanIlogtheclientIPaddressonthebackend |date=March 29, 2008 }} regarding logging</ref> |
|||
[[IronPort]] Web Security Appliance,<ref>[http://www.ironport.com/products/web_security_appliances.html IronPort Web Security Appliances]. Ironport.com (2012-11-26). Retrieved on 2012-12-24.</ref> |
|||
AVANU WebMux, |
|||
[[Array Networks]], |
|||
[[Radware]]'s AppDirector, Alteon ADC, ADC-VX, and ADC-VA, |
|||
[[BIG-IP|F5 Big-IP]],<ref>{{cite web |url=http://devcentral.f5.com/weblogs/macvittie/archive/2008/06/02/3323.aspx |title=Using "X-Forwarded-For" in Apache or PHP |publisher=devcentral.f5.com}}</ref> |
|||
Blue Coat ProxySG,<ref>[http://bluecoat.force.com/knowledgebase/articles/Solution/HowdoIenabletheHTTPX-Forwarded-ForheaderonaProxySG Bluecoat Knowledge Base Article 000010319] {{Webarchive|url=https://web.archive.org/web/20150215232404/http://bluecoat.force.com/knowledgebase/articles/Solution/HowdoIenabletheHTTPX-Forwarded-ForheaderonaProxySG |date=2015-02-15 }}. Kb.bluecoat.com (2009-06-29). Retrieved on 2014-03-06.</ref> |
|||
[[Cisco Systems|Cisco]] Cache Engine, |
|||
McAfee Web Gateway, |
|||
Phion Airlock, |
|||
Finjan's Vital Security, |
|||
[[NetApp NetCache]], |
|||
jetNEXUS, |
|||
Crescendo Networks' Maestro, |
|||
Web Adjuster, |
|||
Websense Web Security Gateway,<ref>{{cite web |url=https://www.websense.com/content/support/library/deployctr/v78/dic_wcg_deploy_spec.aspx#598279 |title=Using "X-Forwarded-For" in Websense WSG|website=Websense.com|access-date=12 November 2017}}</ref> |
|||
[[Microsoft Forefront Threat Management Gateway]] 2010 (TMG)<ref>{{cite web|url=http://www.winfrasoft.com/x-forwarded-for|title=Winfrasoft - X-Forwarded-For - for TMG, ISA Server and IIS|website=Winfrasoft.com|access-date=12 November 2017}}</ref> |
|||
and |
|||
NGINX.<ref>{{cite web|url=http://nginx.com/resources/admin-guide/reverse-proxy/|title=NGINX Reverse Proxy - NGINX|website=Nginx.com|access-date=12 November 2017}}</ref> |
|||
X-Forwarded-For logging is supported by many web servers including Apache. IIS can also use a HTTP Module for this filtering.<ref>[http://www.winfrasoft.com/x-forwarded-for Winfrasoft XFF for IIS]. Winfrasoft.com</ref><ref>[http://www.iis.net/downloads/microsoft/advanced-logging IIS Advanced Logging]. Iis.net (2009-08-10). Retrieved on 2013-06-05.</ref><ref>[http://devcentral.f5.com/weblogs/Joe/archive/2009/12/23/x-forwarded-for-http-module-for-iis7-source-included.aspx X-Forwarded-For HTTP Module For IIS7, Source Included! by Joe Pruitt] Devcentral.f5.com. (2013-07-05).</ref> |
|||
Zscaler will mask an X-Forwarded-For header with Z-Forwarded-For, before adding its own X-Forwarded-For header identifying the originating customer IP address. This prevents internal IP addresses leaking out of Zscaler Enforcement Nodes, and provides third party content providers with the true IP address of the customer. This results in a non-RFC compliant HTTP request. |
|||
==Load balancers== |
|||
* AVANU WebMux Network Traffic Manager, an application delivery network load balancing solution inserts the X-Forwarded-For header by default in One-Armed Single Network Mode and is available as a farm option in Two-Armed NAT, Two-Armed Transparent, and One-Armed Direct Server Return Modes.<ref>{{cite web|url=http://avanu.com/webmux-tech-tips/|title=WebMux Technical Resources - Application Delivery Network Load Balancing|website=Avanu.com|access-date=12 November 2017}}</ref> |
|||
* Barracuda Load Balancer from [[Barracuda Networks]] supports user-defined headers such as X-Forwarded-For to insert the client IP address into a client request.<ref>{{cite web|url=https://campus.barracuda.com/product/loadbalancer/article/display/BLBv42/3539006/|title=Layer 7 HTTP(S) Services|first=Barracuda Networks|last=Inc|website=Barracuda Campus|access-date=12 November 2017}}</ref> |
|||
* [[Citrix Systems]]' NetScaler supports user-defined fields such as X-Forwarded-For to insert the client IP address into a client request.<ref>[https://archive.is/20130119134019/http://support.citrix.com/article/CTX121834 Citrix NetScaler Traffic Management Guide – Release 9.1]... Support.citrix.com. Retrieved on 2012-12-24.</ref> |
|||
* Cisco ACE Load Balancing Modules can also insert this field, usually implemented when the load balancer is configured to perform [[source NAT]], to allow the load balancer to exist in a [[one-armed router|one-armed configuration]], while providing a mechanism that the real servers can use to account for client source IP address. The reference mentions x-forward, however X-Forwarded-For can be substituted.<ref>[http://www.cisco.com/en/US/products/hw/modules/ps2706/products_configuration_example09186a00809c3041.shtml Cisco ACE with Source NAT and Client IP Header]. Cisco.com. Retrieved on 2012-12-24.</ref> |
|||
* [[F5 Networks]] load balancers support {{sic|hide=y|X-Forwarded-For for}} one-armed and multi-armed configurations.<ref>[http://support.f5.com/kb/en-us/solutions/public/4000/800/sol4816.html Using the X-Forwarded-For HTTP header field to preserve the original client IP address for traffic translated by a SNAT]. Support.f5.com (2012-09-26). Retrieved on 2012-12-24.</ref> Big-IP may also be configured to delegate trust to proxies more than one hop away, and accept custom X-Forwarded-For headers from other sources.<ref>[http://support.f5.com/kb/en-us/solutions/public/12000/200/sol12264.html Overview of the Trusted X-Forwarded-For header]. Support.f5.com (2012-09-26). Retrieved on 2012-12-24.</ref> |
|||
* LineRate virtual load balancers support X-Forwarded-For via command line drive configurations, or via node.js scripts.<ref>[https://devcentral.f5.com/articles/inserting-x-forwarded-for-header-with-linerate Inserting X-Forwarded-For header with LineRate (12/29/2014)] Retrieved on 2015-10-05.</ref> |
|||
* [[KEMP Technologies]] LoadMaster supports X-Forwarded-For for non-transparent load balancing in both [[one-armed router|one-armed configuration]] and multi-armed configurations.<ref>[http://www.kemptechnologies.com/documentation LoadMaster Product Manual]. Kemptechnologies.com. Retrieved on 2012-12-24.</ref> |
|||
* [[Coyote Point Systems]] Equalizer supports X-Forwarded-For fields for load balancing in both [[one-armed router|one-armed configuration]] and multi-armed configurations.<ref>[http://www.coyotepoint.com/document-center.php Equalizer User Guide]. Coyotepoint.com. Retrieved on 2012-12-24.</ref> |
|||
* [[OpenBSD]] relays can insert and/or alter this field.<ref>[https://man.openbsd.org/relayd.conf.5#RELAYS relayd.conf manual page]. Openbsd.org (2017-11-29). Retrieved on 2018-02-04.</ref> |
|||
* [[Amazon Elastic Compute Cloud|Amazon's Elastic Load Balancing service]] supports this field. |
|||
* [[LBL LoadBalancer]] supports {{sic|hide=y|X-Forwarded-For for}} one-armed and multi-armed configurations. |
|||
* [[Radware]] AppDirector ADC, Alteon ADC, ADC-VX, and ADC-VA support inserting an {{sic|hide=y|X-Forwarded-For for}} header for traffic that is Source NAT towards servers, as well, as being capable of providing persistency of traffic based on the X-Forwarded-For header for distributing traffic from a proxied connection to multiple servers while preserving persistency to servers. |
|||
* Loadbalancer.org Enterprise load balancers support X-Forwarded-For load balancing by default <ref>[https://www.loadbalancer.org/blog/iis-and-x-forwarded-for-header/ Loadbalancer.org X-forwarded-for].Loadbalancer.org. Retrieved on 2017-12-15.</ref> |
|||
==Alternatives and variations== |
==Alternatives and variations== |
||
{{IETF RFC|7239}} standardized a <code>Forwarded</code> HTTP header with similar purpose but more features compared to the <code>X-Forwarded-For</code> HTTP header.<ref name="RFC_7239">{{cite IETF |
|||
| title = Forwarded HTTP Extension |
| title = Forwarded HTTP Extension |
||
| rfc = 7239 |
| rfc = 7239 |
||
Line 93: | Line 50: | ||
}}</ref> An example of a <code>Forwarded</code> header's syntax: |
}}</ref> An example of a <code>Forwarded</code> header's syntax: |
||
Forwarded: for=192.0.2.60;proto=http;by=203.0.113.43 |
Forwarded: for=192.0.2.60;proto=http;by=203.0.113.43 |
||
Forwarded: for="[2001:db8::1234]" |
|||
[[HAProxy]] defines the PROXY protocol which can communicate the originating client's IP address without using the <code>X-Forwarded-For</code> or <code>Forwarded</code> header.<ref>[http://haproxy.1wt.eu/download/1.5/doc/proxy-protocol.txt Willy Tarreau: The PROXY protocol]. haproxy.1wt.eu. Retrieved on 2012-12-24.</ref> This protocol can be used on multiple transport protocols and does not require inspecting the inner protocol, so it is not limited to HTTP. |
[[HAProxy]] defines the PROXY protocol which can communicate the originating client's IP address without using the <code>X-Forwarded-For</code> or <code>Forwarded</code> header.<ref>[http://haproxy.1wt.eu/download/1.5/doc/proxy-protocol.txt Willy Tarreau: The PROXY protocol]. haproxy.1wt.eu. Retrieved on 2012-12-24.</ref> This protocol can be used on multiple transport protocols and does not require inspecting the inner protocol, so it is not limited to HTTP. |
||
Line 103: | Line 61: | ||
==References== |
==References== |
||
⚫ | |||
⚫ | |||
==External links== |
==External links== |
Latest revision as of 04:04, 29 October 2023
HTTP |
---|
![]() |
Request methods |
Header fields |
Response status codes |
Security access control methods |
Security vulnerabilities |
The X-Forwarded-For (XFF) HTTP header field is a common method for identifying the originating IP address of a client connecting to a web server through an HTTP proxy or load balancer.
The X-Forwarded-For
HTTP request header was introduced by the Squid caching proxy server's developers.[citation needed]
X-Forwarded-For
is also an email-header indicating that an email-message was forwarded from one or more other accounts (probably automatically).[1]
Without the use of XFF or another similar technique, any connection through the proxy would reveal only the originating IP address of the proxy server, effectively turning the proxy server into an anonymizing service, thus making the detection and prevention of abusive accesses significantly harder than if the originating IP address were available. The usefulness of XFF depends on the proxy server truthfully reporting the original host's IP address; for this reason, effective use of XFF requires knowledge of which proxies are trustworthy, for instance by looking them up in a whitelist of servers whose maintainers can be trusted.
Format
[edit]The general format of the field is:[2]
X-Forwarded-For: client, proxy1, proxy2
where the value is a comma+space separated list of IP addresses, the left-most being the original client, and each successive proxy that passed the request adding the IP address where it received the request from. In this example, the request passed through proxy1, proxy2, and then proxy3 (not shown in the header). proxy3 appears as remote address of the request.
Examples:[3]
X-Forwarded-For: 203.0.113.195, 70.41.3.18, 150.172.238.178 X-Forwarded-For: 203.0.113.195 X-Forwarded-For: 2001:db8:85a3:8d3:1319:8a2e:370:7348
Because the X-Forwarded-For header is not formally standardized, some variations to the IP address format exist. For example, some implementations[which?] include the port number of clients, or enclose IPv6 addresses in square brackets even without the port number, similar to the format in the newer Forwarded
header. Examples:
X-Forwarded-For: 203.0.113.195:41237, 198.51.100.100:38523 X-Forwarded-For: [2001:db8::1a2b:3c4d]:41237, 198.51.100.100:26321 X-Forwarded-For: [2001:db8::aa:bb]
Usage
[edit]The X-Forwarded-For header is added or edited by HTTP proxies when forwarding a request. The server appends the address of the client to an existing X-Forwarded-For header separated by a comma, or creates a new X-Forwarded-For header with the client address as the value.
Since it is easy to forge an X-Forwarded-For field the given information should be used with care. The right-most IP address is always the IP address that connects to the last proxy, which means it is the most reliable source of information. X-Forwarded-For data can be used in a forward or reverse proxy scenario. If the server is behind a trusted reverse proxy and only allows connections from that proxy, the header value can usually be assumed to be trustworthy.
Just logging the X-Forwarded-For field is not always enough as the last proxy IP address in a chain is not contained within the X-Forwarded-For field, it is in the actual IP header. A web server should log both the request's source IP address and the X-Forwarded-For field information for completeness.
Alternatives and variations
[edit]RFC 7239 standardized a Forwarded
HTTP header with similar purpose but more features compared to the X-Forwarded-For
HTTP header.[4] An example of a Forwarded
header's syntax:
Forwarded: for=192.0.2.60;proto=http;by=203.0.113.43 Forwarded: for="[2001:db8::1234]"
HAProxy defines the PROXY protocol which can communicate the originating client's IP address without using the X-Forwarded-For
oder Forwarded
header.[5] This protocol can be used on multiple transport protocols and does not require inspecting the inner protocol, so it is not limited to HTTP.
See also
[edit]- Internet privacy
- List of proxy software
- X-Originating-IP for SMTP equivalent
- List of HTTP header fields
References
[edit]- ^ "Overview of parsed mail headers". Archived from the original on 2014-09-20. Retrieved 2014-05-05.
- ^ "squid : follow_x_forwarded_for configuration directive". Squid-cache.org. Retrieved 12 November 2017.
- ^ "X-Forwarded-For". MDN Web Docs. Retrieved 2020-11-06.
- ^ Petersson, A; Nilsson, M (June 2014). Forwarded HTTP Extension. IETF. doi:10.17487/RFC7239. RFC 7239. Retrieved February 20, 2020.
- ^ Willy Tarreau: The PROXY protocol. haproxy.1wt.eu. Retrieved on 2012-12-24.
External links
[edit]- Apache mod_extract_forwarded