Forum Discussion

BaltoStar_12467's avatar
Jun 30, 2015

BIG-IP : http profile : insert x-forwarded-for : enabled

F5 BIG-IP Virtual Edition v11.4.1 (Build 635.0) LTM on ESXi

HTTP Profile
Insert X-Forwarded-For : Enabled

Suppose the client has already added the "X-Forwarded-For" header value to the request. How will BIG-IP behave ? Will it leave the existing header value intact ? Or will it overwrite the value with what it believes to be the request client ip ?

Further, at what point in request-processing does the insert/replace header operation occur ? Does it occur before iRule processing so that the header value is available within the iRule event processing

when HTTP_REQUEST {}
?

  • Greg_Chew_31149's avatar
    Greg_Chew_31149
    Historic F5 Account
    From: https://support.f5.com/kb/en-us/solutions/public/4000/800/sol4816.html Many servers and applications expect only a single X-Forwarded-For header, per request. However, the BIG-IP system appends a new X-Forwarded-For header to the existing set of HTTP headers, even if there is an existing X-Forwarded-For header in the request. Both approaches are valid according to the Internet Engineering Task Force (RFC2616, Section 4.2). For applications expecting a single X-Forwarded-For header, it is possible to use an iRule instead of the HTTP profile option to append the client IP value to the end of any existing X-Forwarded-For header. F5 DevCentral iRules codeshare contains an example of such an iRule: X Forwarded For Single Header Insert. A DevCentral login is required to access this content. https://devcentral.f5.com/s/feed/0D51T00006i7OV1SAM
  • for the case where the incoming request contains a collection of one or more XFF headers , what are the reasons behind BIG-IP's default practice of appending a new XFF header to the end of the collection ( as opposed to consolidating existing values into a comma-separated list of IPs stored in a single XFF header ) ?
  • You can create an iRule which only adds the XFF Header if there is none in the request. In this case you disable the setting in the HTTP Profile.

     

    • BaltoStar_12467's avatar
      BaltoStar_12467
      sure you can implement any custom logic whatsoever in an iRule ... but that wasn't my question
  • You can create an iRule which only adds the XFF Header if there is none in the request. In this case you disable the setting in the HTTP Profile.

     

    • BaltoStar_12467's avatar
      BaltoStar_12467
      sure you can implement any custom logic whatsoever in an iRule ... but that wasn't my question