Do proxies and/or load balancers alter HTTP query strings by default

load balancingPROXYquerystringreverse-proxy

Introduction to the problem

Recently I was working on some request signing algorithm and it came out the opinions about including query string in the part that is then signed are "diversified".

Long story short, the argument of the person against including query string in the string for signing is that the query strings can be altered (eg. values can be changed, arguments can be removed/added, order can be changed).

Also I have never ever experienced such behaviour in proxy or load balancer, even though I experienced such things as hiding Authorization header (eg. by Apache/WSGI), altering method of the request (by load balancer, probably Amazon's servers do such thing). I know such behaviour can be enabled on reverse proxy or load balancer, using some custom scripts / rules, but it could be done with any part of the request.

A lot of work has been done based on the assumption query string should be included, plus it looks silly to not sign one of the most important parts of the request. Thus I need to know if including query string in the raw form (as it is passed within the URL) will be an issue in the future or not.

Actual question

So my question is:

Is it common for any proxy or load balancer to alter query strings? It seems silly for me. Do you know any proxy or load balancer (software or its installation) that does that by default?

I am sure in such case we can handle signature verification on the level of proxy/load balancer, but it may be a viable argument if this is common among the intermediaries we do not control.

Please, let me know what you know about it. Let me know, if you have any questions.

As a clarification, by query string I mean the "?arg1=val1&arg2=val2" part of the following URL:

http://example.com/something/else?arg1=val1&arg2=val2

And by "altering the query string" I mean any action that could make it look different for the client and for the server (server sees query string different than the client has used).

Best Answer

Many modern reverse-proxies could alter the query-strings. But i see no reason why a load-balancer or proxy will do that by default.

Maybe it uses the URI for sticky session load-balancing, but that would be really stupid.

So: No, i don't know any load-balancer, altering the uri and the parameters by default.