-
Notifications
You must be signed in to change notification settings - Fork 264
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[BUG] X-Forwarded-For parsing is incorrect #326
Comments
Hi, thanks for the issue. We will check if your proposal doesn't create new issue then make a fix. |
I should be able to look into this this week, I will pick it up. |
@Blokje5 my 2 cents since I started to look.
I quickly looked at the code and the fix doesn't seem dangerous. I let you have a second look then apply the fix (or not). |
Having spaces or no spaces results in equivalent headers in RFC 7239: As an example, the header field Forwarded: for=192.0.2.43,for="[2001:db8:cafe::17]",for=unknown is equivalent to the header field Forwarded: for=192.0.2.43, for="[2001:db8:cafe::17]", for=unknown This PR fixes ContentSquare#326 because we treated spaces as mandatory in the Forwarded Header. Signed-off-by: Lennard Eijsackers <lennardeijsackers92@gmail.com>
Having spaces or no spaces results in equivalent headers in RFC 7239: As an example, the header field Forwarded: for=192.0.2.43,for="[2001:db8:cafe::17]",for=unknown is equivalent to the header field Forwarded: for=192.0.2.43, for="[2001:db8:cafe::17]", for=unknown This PR fixes #326 because we treated spaces as mandatory in the Forwarded Header. Signed-off-by: Lennard Eijsackers <lennardeijsackers92@gmail.com>
FYI the version containing the fix should be released btw 1 or 3 weeks |
Describe the bug
Chproxy use ", " (comma with space) as a separator for elements in header. In result, when chproxy receives request from GCP HTTP load balancer, it ignores header at all, because GCP LB use only comma symbol (space is optional by RFC7239).
To Reproduce
curl -i -H "x-forwarded-for: 1.1.1.1,2.2.2.2" asdf@127.0.0.1:8123/?query=select%201
Expected behavior
Removing of space fix this issue:
The text was updated successfully, but these errors were encountered: