Trusts addresses from the client provided X-Forwarded-For header #45

Activity

1. Gunni commented on Jul 11, 2019

   

   Gunni

   on Jul 11, 2019

   Last edited by Gunni

   Author

   More actions

   Just discovered the strict keyword, not documented on https://caddyserver.com/docs/http.ipfilter

   This behaviour is a bad default.

   Suggestion: default to strict but allow the admin to provide an array of trusted proxy IPs where you can trust this header.