-
Bug
-
Resolution: Done
-
Major
-
2.0.3.Final
-
None
Our application is setup like this:
We obviously need to know the real client address inside the application. This is normally achieved by forwarding the client address inside the X-Forwarded-For header through the load balancer chain.
Undertow, when used as a load balancer / proxy, provides two ways to handle X-Forwarded-* headers that arrive within the request (from a load balancer that handles the request before Undertow):
- reuseXForwarded setting of ProxyHandler - "inspect already existing X-Forwarded-* headers, append information about the current node"
- ProxyPeerAddressHandler - "take X-Forwarded-* headers and pretend that they contain real client address, protocol, etc"
The problems:
- reuseXForwarded cannot be set when Undertow's mod-proxy filter is used, because ProxyHandler instance gets dynamically built / instantiated by ModCluster and there's no possibility to control reuseXForwarded's value
- ProxyHandler, when used together with ProxyPeerAddressHandler (in Wildfly, this can be done by setting "proxy-address-forwarding" of "http-listener" to true), does not use sourceAddress set by ProxyPeerAddressHandler, but rather reads exchange.getConnection().getPeerAddress(). This ticket is about this bug.