Nginx clear X-Forwarded-For before setting

nginxPROXYsslx-forwarded-for

What can I use in the nginx config to make it clear any existing X-Forwarded-For headers before setting its own? I am currently using Nginx to terminate SSL before passing traffic to HAProxy to load balance.

Right now, I have:

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

This will append a new IP address to the end of any existing X-Forwarded-For IP addresses however. Is there a way to only keep the address seen by Nginx?

Best Answer

Just don't use $proxy_add_x_forwarded_for - the whole purpose that it exists is to do the appending behavior.

Instead:

proxy_set_header X-Forwarded-For $remote_addr;

Related Solutions

Load Balancers – Why No Examples of Horizontally Scalable SSL

The "simplest thing", in all seriousness, is to move to a centralised session store. You've got to setup all this plumbing with load balancers, haproxy, SSL, and the rest of it, when every bit of session-handling code I've ever seen makes it near-trivial to plug in different storage engines, so a bit of code and very, very little extra complexity solves all your problems.

Use HAproxy with SSL and X-Forwarded-For Headers – PHP SSL Configuration Guide

You dont need to drop it all, you could just use nginx in front of haproxy for SSL support, keeping all your load balancing config. You dont even need to use nginx for HTTP if you don't want to. Nginx can pass both X-Forwarded-For and a custom header indicating SSL is in use (and client cert information if you want). Nginx config snippet that sends required information:

proxy_set_header SCHEME $scheme;      # http/https
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header CLIENT_CERT $ssl_client_raw_cert;

Best Answer

Related Solutions

Load Balancers – Why No Examples of Horizontally Scalable SSL

Use HAproxy with SSL and X-Forwarded-For Headers – PHP SSL Configuration Guide

Related Topic