Quantcast



Docs


Blogs


Forums


Samples


Media


Labs


Resources

 




DevCentral > Weblogs > Joe Pruitt - A Software Architect's take on Network Security
 The Networking ABC's - X is for X-Forwarded-For
posted on Friday, May 16, 2008 9:39 AM

abc

Today's word in the Networking ABC's is the letter X.  There really aren't that many words that start with X so my choices for today was limited.  But, luckily for you all, there is one word that stands out as a necessity for application servers hosted behind HTTP proxies.  The "X-Forwarded-For" HTTP header is used to allow a proxy server to inject the true originating IP address of a client connection into the HTTP request allowing the application server to know the callers true identity.

"X" is for X-Forwarded-For

X-Forwarded-For

Pronounced: Eks-Fôr'wərd-ed-Fawr

The X-Forwarded-For (XFF) HTTP header is a de facto standard for identifying the originating IP address of a client connecting to a web server through an HTTP proxy.  In this context, the caching servers are most often those of large ISPs who either encourage or force their users to use proxy servers for access to the Internet.  Without the use of XFF, any connection through the proxy would reveal only the originating IP address of the proxy server, effectively turning the proxy server into an anonymizing service, thus making detection and prevention of abusive accesses significantly harder than if the originating IP address was available.



Email This
  del.icio.us
      

Feedback


7/28/2008 7:50 AM
Gravatar Hi Joe,

I'm glad to come across this posting. I have had some difficulties in getting the Client IP address. As it's currently, the Weblogic access.log it's only showing the load balancer's addresses. I have set the Header to Insert to X-Forwarded-For: ${client_addr} and within Weblogic 9x, I have enabled Weblogic Plug-in and added option c-ip to the extended logging format field but the attempts has been unsuccessful. Can you please point me in the right direction.

Thank you in advance.
Ben
 Leave Feedback
Title  
Name  
Email
Url
Comments   
Please add 5 and 6 and type the answer here: