Options for X-Forwarded-For header with Cloudfront->ELB->Haproxy flow

0

A customer is implementing Cloudfront with ELB and HAProxy on EC2. They are also evaluating AWS WAF for protecting App Traffic but because of application requirements they may not be able to move to ALB and hence cant work with WAF for this workload.

They are looking at implementing Access Control at HAProxy layer. But have expressed concerns around reliability of X-Forwarded-For headers as reliable source to implement it. I wanted to seek expert thoughts on better alternatives to help them implement this.

AWS
raj_b
asked 4 years ago3428 views
1 Answer
0
Accepted Answer

Yes. X-Forwarded-For Header can be manipulate.
So, You can use Lambda@Edge for origin request phase to overwrite X-Forwarded-For header or create other header like True-Client-IP.

Simple example is below.

'use strict';

exports.handler = function(event, context, callback) {  
  var request = event.Records[0].cf.request;  
  request.headers["true-client-ip"] = [{"key":"True-Client-IP","value":request.clientIp}]   
  request.headers["x-forwarded-for"] = [{"key":"X-Forwarded-For","value":request.clientIp}]  

  callback(null, request);  
};

please check other L@E samples below. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-examples.html

AWS
answered 4 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions