From ab3ad426259746c259e09fd2472de485c7bfc85c Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Fri, 18 Sep 2026 16:19:23 -0700 Subject: [PATCH] fix(haproxy): set X-CLIENT-IP instead of adding it add-header let a client-supplied X-CLIENT-IP survive next to ours, so a backend reading the first occurrence got the attacker's value. set-header replaces any inbound copy. Refs #10. Co-Authored-By: Claude Sonnet 5 --- templates/hap_backend.tpl | 4 ++-- templates/hap_backend_http_check.tpl | 2 +- templates/hap_backend_longlived.tpl | 4 ++-- templates/hap_backend_websocket.tpl | 4 ++-- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/templates/hap_backend.tpl b/templates/hap_backend.tpl index 6b19e48..bc10012 100644 --- a/templates/hap_backend.tpl +++ b/templates/hap_backend.tpl @@ -4,7 +4,7 @@ backend {{ name }}-backend option forwardfor # Pass the real client IP to backend (from proxy headers or direct connection) # This is crucial for container-level logging and security tools - http-request add-header X-CLIENT-IP %[var(txn.real_ip)] + http-request set-header X-CLIENT-IP %[var(txn.real_ip)] http-request set-header X-Real-IP %[var(txn.real_ip)] http-request set-header X-Forwarded-For %[var(txn.real_ip)] http-request set-header X-Forwarded-Proto https if { ssl_fc } @@ -29,7 +29,7 @@ backend {{ name }}-sse-backend option forwardfor # Pass the real client IP to backend (from proxy headers or direct connection) - http-request add-header X-CLIENT-IP %[var(txn.real_ip)] + http-request set-header X-CLIENT-IP %[var(txn.real_ip)] http-request set-header X-Real-IP %[var(txn.real_ip)] http-request set-header X-Forwarded-For %[var(txn.real_ip)] http-request set-header X-Forwarded-Proto https if { ssl_fc } diff --git a/templates/hap_backend_http_check.tpl b/templates/hap_backend_http_check.tpl index fee7b5c..503cfd6 100644 --- a/templates/hap_backend_http_check.tpl +++ b/templates/hap_backend_http_check.tpl @@ -4,7 +4,7 @@ backend {{ name }}-backend option httpchk # Pass the real client IP to backend (from proxy headers or direct connection) # This is crucial for container-level logging and security tools - http-request add-header X-CLIENT-IP %[var(txn.real_ip)] + http-request set-header X-CLIENT-IP %[var(txn.real_ip)] http-request set-header X-Real-IP %[var(txn.real_ip)] http-request set-header X-Forwarded-For %[var(txn.real_ip)] {% if ssl_enabled %}http-request set-header X-Forwarded-Proto https if { ssl_fc }{% endif %} diff --git a/templates/hap_backend_longlived.tpl b/templates/hap_backend_longlived.tpl index ba9df50..b06a736 100644 --- a/templates/hap_backend_longlived.tpl +++ b/templates/hap_backend_longlived.tpl @@ -14,7 +14,7 @@ backend {{ name }}-backend timeout tunnel 6h timeout http-keep-alive 6h option forwardfor - http-request add-header X-CLIENT-IP %[var(txn.real_ip)] + http-request set-header X-CLIENT-IP %[var(txn.real_ip)] http-request set-header X-Real-IP %[var(txn.real_ip)] http-request set-header X-Forwarded-For %[var(txn.real_ip)] http-request set-header X-Forwarded-Proto https if { ssl_fc } @@ -31,7 +31,7 @@ backend {{ name }}-sse-backend timeout tunnel 6h timeout http-keep-alive 6h option forwardfor - http-request add-header X-CLIENT-IP %[var(txn.real_ip)] + http-request set-header X-CLIENT-IP %[var(txn.real_ip)] http-request set-header X-Real-IP %[var(txn.real_ip)] http-request set-header X-Forwarded-For %[var(txn.real_ip)] http-request set-header X-Forwarded-Proto https if { ssl_fc } diff --git a/templates/hap_backend_websocket.tpl b/templates/hap_backend_websocket.tpl index 10a4133..e4c1172 100644 --- a/templates/hap_backend_websocket.tpl +++ b/templates/hap_backend_websocket.tpl @@ -7,7 +7,7 @@ backend {{ name }}-backend timeout tunnel 6h timeout http-keep-alive 6h option forwardfor - http-request add-header X-CLIENT-IP %[var(txn.real_ip)] + http-request set-header X-CLIENT-IP %[var(txn.real_ip)] http-request set-header X-Real-IP %[var(txn.real_ip)] http-request set-header X-Forwarded-For %[var(txn.real_ip)] http-request set-header X-Forwarded-Proto https if { ssl_fc } @@ -24,7 +24,7 @@ backend {{ name }}-sse-backend timeout tunnel 6h timeout http-keep-alive 6h option forwardfor - http-request add-header X-CLIENT-IP %[var(txn.real_ip)] + http-request set-header X-CLIENT-IP %[var(txn.real_ip)] http-request set-header X-Real-IP %[var(txn.real_ip)] http-request set-header X-Forwarded-For %[var(txn.real_ip)] http-request set-header X-Forwarded-Proto https if { ssl_fc }