Skip to content

HTTP reverse proxy doesn't accumulate X-Forwarded-For #3846

@gopherbot

Description

@gopherbot

by brian@streampunks.com:

Currently, in net/http/httputil/reverseproxy.go in ServeHTTP the code currently replaces
any prior value set to X-Forwarded-For. The de-facto standard is to append the value for
each additional proxy. You can see the problem by simply running the go reverse proxy
behind another proxy and the header will be replaced.

The problem is trivial to fix by replacing the Set call in this:

    outreq.Header.Set("X-Forwarded-For", clientIp)

to an Add like this:

    outreq.Header.Add("X-Forwarded-For", clientIp)

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions