Comment by adamcharnock | Hacker News Reader

Comment by adamcharnock | Hacker News Reader

This seems to be failing the X-Forwarded-For validation on my site. I expect one X-Forwarded-For header entry on my (Heroku hosted) site, but requests from the measure tool [1] seem to have two entries in this header.

Example log entry:

    2020-05-05T23:00:07.144973+00:00 heroku[router]: at=info method=GET path="/en/" host=redacted.com request_id=a0c8605f-e67a-4b48-9538-c6bafebaaaaa fwd="107.178.238.42,66.249.84.103" dyno=web.1 connect=1ms service=4ms status=400 bytes=294 protocol=https

Is this expected behaviour?

[1] https://web.dev/measure/

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-...

>If a request goes through multiple proxies, the IP addresses of each successive proxy is listed. This means, the right-most IP address is the IP address of the most recent proxy and the left-most IP address is the IP address of the originating client.

I don't see why you would only have one of those headers. There are use cases for two proxies to operate (think a corporate proxy + your proxy, or a corporate proxy to a privoxy instance to your proxy, a corporate proxy connecting to a data-saving proxy, etc.). Some proxies like to add these headers by default. Duplicate headers are acceptable in HTTP, so this is all perfectly up to spec.

In this case, if your reverse proxy is adding its own header, it should be stripping away the other X-Forwarded-For headers if you so wish, or have the application pick the appropriate header if you wish to receive all of them. This sounds like a misconfiguration issue on your website to me.

Reply on news.ycombinator.com