rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use rightmost IP from forwarded headers

Browse Source 
A client can prepend a spoofed entry to X-Forwarded-For before
the request reaches our load balancer. Taking the first value
would return the attacker's address. Since we sit behind a
single trusted LB that appends the real client IP as the last
entry, switch to rightmost extraction for both X-Forwarded-For
and RFC 7239 Forwarded headers.

Signed-off-by: Émile Ré <emile@getprobo.com>
This commit is contained in:
Émile Ré
2026-04-29 14:16:37 +04:00
parent c0d96e662e
commit 9920093c22
2 changed files with 17 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
pkg/server/api/clientip/clientip.go
View File

@@ -22,7 +22,9 @@ import (
// Extract resolves the client IP address from standard proxy headers
// in priority order: RFC 7239 Forwarded, then X-Forwarded-For, then
// the connection's remote address.
// the connection's remote address. It takes the rightmost (last)
// entry from multi-value headers — the one appended by the trusted
// load balancer closest to us.
func Extract(r *http.Request) string {
if fwd := r.Header.Get("Forwarded"); fwd != "" {
if ip := parseForwardedFor(fwd); ip != "" {
@@ -31,8 +33,8 @@ func Extract(r *http.Request) string {
}
if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
if i := strings.IndexByte(xff, ','); i != -1 {
xff = xff[:i]
if i := strings.LastIndexByte(xff, ','); i != -1 {
xff = xff[i+1:]
}
xff = strings.TrimSpace(xff)
@@ -50,11 +52,11 @@ func Extract(r *http.Request) string {
return ip
}
// parseForwardedFor extracts the client IP from the first "for=" directive
// parseForwardedFor extracts the client IP from the last "for=" directive
// of an RFC 7239 Forwarded header value.
func parseForwardedFor(header string) string {
if i := strings.IndexByte(header, ','); i != -1 {
header = header[:i]
if i := strings.LastIndexByte(header, ','); i != -1 {
header = header[i+1:]
}
for part := range strings.SplitSeq(header, ";") {