Item — HN Reader

load balancer / proxy, since you need a way to get the real ip

If it is at all helpful most layer-7 load balancers have an option to enable a header that contains the real IP address, then one need only reconfigure their web daemon to log that header. It's very similar to how CDN's send the real IP in a header.

1 comments

And it's almost certainly exploitable by a client sending that same header.

Most load balancers will silently drop the real IP address header on the ingress side to avoid exactly what you are describing. That used to be a thing around 2000 - 2001 era. If you find a load balancer with that issue today open a case with their vendor.

Not reliably enough. Look for parser differentials.

Please enlighten us

Differences in parsing between two systems can allow data to sneak through. For example you might put a space before the header name. The reverse proxy might treat it as a header name starting with a space, so not matching the one it wants to remove, and not removed, while the origin server trims the space.

This is a ubiquitous security concern, like IDOR and memory safety. Every time you have a separate validation step for anything, you have the possibility of a parser differential vulnerability.

If you don't know it yet, look up "HTTP request smuggling" - pretty interesting.