Skip to content

add support for proxy headers#744

Merged
jessepeterson merged 1 commit intomicromdm:mainfrom
korylprince:add-xff
Jul 22, 2021
Merged

add support for proxy headers#744
jessepeterson merged 1 commit intomicromdm:mainfrom
korylprince:add-xff

Conversation

@korylprince
Copy link
Contributor

Right now, if you run micromdm behind a reverse proxy, logs always show the same request host (the proxy itself). This adds a middleware that parses X-Forwarded-For, X-Real-IP, etc headers that reverse proxies set so the downstream handlers (i.e. loggers) see the real client IP.

This is hidden behind a default-off flag, as you don't want to parse these headers unless you're behind a trusted proxy.

@jessepeterson
Copy link
Member

If this is just for logging I might suggest this happens in groob/finalizer. Reason being that because we're using structured logs we can just as well log both the remote addr and the rproxy headers together. No need to lose the actual remote ip (say, in the case you have multiple proxies).

But I dunno, I could see it both ways. Thoughts?

@korylprince
Copy link
Contributor Author

The middleware only modifies the request.RemoteAddr, request.URL.Scheme, and/or request.Host, depending on what headers are passed. It doesn't appear that any code in the micromdm repository accesses any of those fields from the request, though I suppose some dependencies might (I didn't check - there are a lot!) This would be the easier approach, and could always be moved elsewhere if the need arises in the future.

I suppose you could copy the relevant code behind the handler to groob/finalizer/logutil to log extra fields, but I guess I prefer the composability of using it as middleware. If you do want the functionality in logutil, there wouldn't be a way put this functionality behind a flag (it's not recommended to parse proxy headers unless behind a trusted proxy) unless you change logutil.NewHTTPLogger's signature or add NewHTTPProxyLogger or something simliar.

I don't really care either way. You and @groob just let me know what you'd like to see, and I can do a PR to groob/finalizer if need be.

@jessepeterson jessepeterson linked an issue Jun 16, 2021 that may be closed by this pull request
@jessepeterson
Copy link
Member

@korylprince looks like we have conflicts. tidy those up and we'll get this merged. i may open a tracking issue for future consideration of adding this to finalizer

@korylprince
Copy link
Contributor Author

@jessepeterson I got this rebased to micromdm:main. Thanks!

@jessepeterson jessepeterson merged commit e2efa7b into micromdm:main Jul 22, 2021
@korylprince korylprince deleted the add-xff branch February 17, 2022 18:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Allow X-Forwarded-For or X-Real-IP

2 participants