shreemaan-abhishek opened a new pull request, #13611: URL: https://github.com/apache/apisix/pull/13611
### Description When the downstream connection is **not** listed in `apisix.trusted_addresses`, `handle_x_forwarded_headers()` cleared the incoming `X-Forwarded-For` header outright. For deployments with a multi-tier proxy chain (e.g. `client -> front proxy -> APISIX -> upstream`) where the front proxy is not added to `trusted_addresses`, the upstream loses the original client IP and only sees the connection IP rebuilt by `$proxy_add_x_forwarded_for`. This is a behavior change from older releases and breaks upstreams that read the client IP from `X-Forwarded-For`. Unlike `X-Forwarded-Proto/Host/Port` and the RFC 7239 `Forwarded` header (which are set wholesale and have no append mechanism, so a forged value would pass straight through), `X-Forwarded-For` has a safe append model: `ngx_tpl` appends the trusted connection IP via `$proxy_add_x_forwarded_for`, so even a client-forged chain always carries the real connection IP as its last hop. Consumers that want the real client IP should anchor on the trusted rightmost hop (this is what the `real-ip` plugin does). This PR keeps `X-Forwarded-For` intact for untrusted sources and continues to overwrite `X-Forwarded-Proto/Host/Port` and clear `Forwarded`. This aligns with the default behavior of Kong, Tyk and Envoy edge mode, which preserve the incoming XFF and append the connection IP. ### Behavior For an untrusted source sending `X-Forwarded-For: 1.2.3.4`: - Before: upstream receives `X-Forwarded-For: <connection-ip>` - After: upstream receives `X-Forwarded-For: 1.2.3.4, <connection-ip>` `X-Forwarded-Proto/Host/Port` and `Forwarded` handling is unchanged. ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [x] I have updated the documentation to reflect this change - [x] I have verified that this change is backward compatible (if not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
