Welcome! Log In Create A New Profile

Advanced

Feature Request: write error logs when detecting duplicate http headers

杨镭
June 07, 2011 11:22AM
Hi:

When duplicate http headers occur(e.g., two X-Forwarded-For headers), nginx
will use the first instance silently. This means internal variables like
$http_x_forwarded_for is not entirely *correct,* users have to capture
packets in the network layer to find out the truth. This is a lot of
inconvenient compared to customize log format.

Also, for headers like "X-Forwarded-For", attackers can intentionaly inject
serveral spoofed ip addresses.

Although nginx cannot possibly known which one is more important than the
others, it MAY alert user by logging "duplicated headers detected,
header:value1, value2, ... value N".

Currently, we use nginx-lua module to detect duplicate headers, like:

itable = ngx.req.get_headers()["X-Forwarded-For"]
for k, v in iparis(itable) do
-- process duplicate header
end




--
lei yang
_______________________________________________
nginx mailing list
nginx@nginx.org
http://nginx.org/mailman/listinfo/nginx
Subject Author Posted

Feature Request: write error logs when detecting duplicate http headers

杨镭 June 07, 2011 11:22AM

Re: Feature Request: write error logs when detecting duplicate httpheaders

Piotr Sikora June 07, 2011 12:06PM

Re: Feature Request: write error logs when detecting duplicate http headers

Justin Cormack June 08, 2011 07:04AM

Re: Feature Request: write error logs when detecting duplicate http headers

smaer780 May 30, 2016 07:06AM



Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 89
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready