Help us improve the AWS re:Post Knowledge Center by sharing your feedback in a brief survey. Your input can influence how we create and update our content to better support your AWS journey.
Options for X-Forwarded-For header with Cloudfront->ELB->Haproxy flow
A customer is implementing Cloudfront with ELB and HAProxy on EC2. They are also evaluating AWS WAF for protecting App Traffic but because of application requirements they may not be able to move to ALB and hence cant work with WAF for this workload.
They are looking at implementing Access Control at HAProxy layer. But have expressed concerns around reliability of X-Forwarded-For headers as reliable source to implement it. I wanted to seek expert thoughts on better alternatives to help them implement this.
- トピック
- ネットワークとコンテンツ配信
- 言語
- English
- 新しい順
- 投票が多い順
- コメントが多い順
Yes. X-Forwarded-For Header can be manipulate.
So, You can use Lambda@Edge for origin request phase to overwrite X-Forwarded-For header or create other header like True-Client-IP.
Simple example is below.
'use strict';
exports.handler = function(event, context, callback) {
var request = event.Records[0].cf.request;
request.headers["true-client-ip"] = [{"key":"True-Client-IP","value":request.clientIp}]
request.headers["x-forwarded-for"] = [{"key":"X-Forwarded-For","value":request.clientIp}]
callback(null, request);
};
please check other L@E samples below. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-examples.html
