shreemaan-abhishek opened a new pull request, #13611:
URL: https://github.com/apache/apisix/pull/13611

   ### Description
   
   When the downstream connection is **not** listed in 
`apisix.trusted_addresses`, `handle_x_forwarded_headers()` cleared the incoming 
`X-Forwarded-For` header outright. For deployments with a multi-tier proxy 
chain (e.g. `client -> front proxy -> APISIX -> upstream`) where the front 
proxy is not added to `trusted_addresses`, the upstream loses the original 
client IP and only sees the connection IP rebuilt by 
`$proxy_add_x_forwarded_for`. This is a behavior change from older releases and 
breaks upstreams that read the client IP from `X-Forwarded-For`.
   
   Unlike `X-Forwarded-Proto/Host/Port` and the RFC 7239 `Forwarded` header 
(which are set wholesale and have no append mechanism, so a forged value would 
pass straight through), `X-Forwarded-For` has a safe append model: `ngx_tpl` 
appends the trusted connection IP via `$proxy_add_x_forwarded_for`, so even a 
client-forged chain always carries the real connection IP as its last hop. 
Consumers that want the real client IP should anchor on the trusted rightmost 
hop (this is what the `real-ip` plugin does).
   
   This PR keeps `X-Forwarded-For` intact for untrusted sources and continues 
to overwrite `X-Forwarded-Proto/Host/Port` and clear `Forwarded`. This aligns 
with the default behavior of Kong, Tyk and Envoy edge mode, which preserve the 
incoming XFF and append the connection IP.
   
   ### Behavior
   
   For an untrusted source sending `X-Forwarded-For: 1.2.3.4`:
   
   - Before: upstream receives `X-Forwarded-For: <connection-ip>`
   - After: upstream receives `X-Forwarded-For: 1.2.3.4, <connection-ip>`
   
   `X-Forwarded-Proto/Host/Port` and `Forwarded` handling is unchanged.
   
   ### Checklist
   
   - [x] I have explained the need for this PR and the problem it solves
   - [x] I have explained the changes or the new features added to this PR
   - [x] I have added tests corresponding to this change
   - [x] I have updated the documentation to reflect this change
   - [x] I have verified that this change is backward compatible (if not, 
please discuss on the [APISIX mailing 
list](https://github.com/apache/apisix/tree/master#community) first)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to