1 pages tagged with "proxy"

At work, I was recently testing and deploying a new HTTPS reverse proxy service. I ran into some weirdness in how Envoy handles the X-Forwarded-For headers when it's configured not to trust the incoming values. I ended up configuring Envoy to just drop all incoming X-Forwarded-* and Forwarded headers, just to be safe.

But this got me thinking: would Envoy even do anything regarding the Forwarded header, if it's designed to mainly use the X-Forwarded-* family of headers? Are there web frameworks that would support both X-Forwarded-* and Forwarded and could this behaviour be abused?

read more