cloud-hosting-platform/haproxy-manager-base
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(haproxy): set X-CLIENT-IP instead of adding it

Browse Source 
add-header let a client-supplied X-CLIENT-IP survive next to ours, so a
backend reading the first occurrence got the attacker's value. set-header
replaces any inbound copy. Refs #10.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
shadowdao
2026-09-18 16:19:23 -07:00
co-authored by Claude Sonnet 5
parent edddb7a9aa
commit b025dec55e
4 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
templates/hap_backend_websocket.tpl
+2 -2
View File
@@ -7,7 +7,7 @@ backend {{ name }}-backend
timeout tunnel 6h
timeout http-keep-alive 6h
option forwardfor
http-request add-header X-CLIENT-IP %[var(txn.real_ip)]
http-request set-header X-CLIENT-IP %[var(txn.real_ip)]
http-request set-header X-Real-IP %[var(txn.real_ip)]
http-request set-header X-Forwarded-For %[var(txn.real_ip)]
http-request set-header X-Forwarded-Proto https if { ssl_fc }
@@ -24,7 +24,7 @@ backend {{ name }}-sse-backend
timeout tunnel 6h
timeout http-keep-alive 6h
option forwardfor
http-request add-header X-CLIENT-IP %[var(txn.real_ip)]
http-request set-header X-CLIENT-IP %[var(txn.real_ip)]
http-request set-header X-Real-IP %[var(txn.real_ip)]
http-request set-header X-Forwarded-For %[var(txn.real_ip)]
http-request set-header X-Forwarded-Proto https if { ssl_fc }