HAProxy rspadd or set-header

haproxyhttp-headers

I am currently trying to improve my HAProxy HTTPS configuration.
There seems to be two ways to set additional fields to response headers in HAProxy.
I currently use http-response set-header, which should, if I understand it right:

Check if the field exist
If it exists, delete it
Set the field to the new value

Some people use rspadd instead, which should simply append the field at the end of the response header.

When working with sensitive fields like for HSTS, set-header feels safer on the paper.
Is there any real difference between both ?
If yes which one should I prefer when setting sensitive fields in my headers ?

Best Answer

The http-response commands are newer (added in 1.5), adding additional functionality and flexibility to the older rspadd/rspdel/etc commands. While they'll both work, it's probably better to stick with http-response for future-compatibility.

Related Solutions

Tomcat – Overriding the X-Forwarded-For header in haproxy

Tear it off the request header, before HAProxy adds its own:

reqidel ^X-Forwarded-For:.*

The risk to this change is that you'll lose your information about the "real" client IP address - your logs will then be showing the IP of the proxy server that the client is using. Sounds like you're ok with that!

As an aside, see this question for some interesting info on confusion over the append order of the X-Forwarded-For header.

Nginx – Haproxy not properly passing on X-Forwarded-For header

To respond to your last question in the comment, it is normal to have more than one IP address in XFF, this header is a list of values, and proxies often add their client's address there. Since everyone in the long chain appends values there, your server must use them in reverse order. For instance, the last value will be the one added by the haproxy instance in front of the server, and the previous value will be the one added by the reverse-cache before haproxy, etc...

If you'd prefer not to adapt the application to correctly parse the header, you can also ask haproxy to remove it before adding its own XFF header:

reqidel ^X-Forwarded-For:

That way the server will only get the value added by haproxy which will be haproxy's client.

Best Answer

Related Solutions

Tomcat – Overriding the X-Forwarded-For header in haproxy

Nginx – Haproxy not properly passing on X-Forwarded-For header

Related Topic