restore REMOTE_ADDR from headers X-Forwarded-For or X-Real-IP

[rapaman]

Hello,

Will be very good to have possibility to restore REMOTE_ADDR from headers X-Forwarded-For or X-Real-IP on backends where used lighttpd, or use any header that was set to restore real ip from.

I think this will be very useful feature for lighttpd.

Thanks.

[andreas]

This will allow anyone to fake their IP address by adding the X-Forwarded-For header.

[anonymous]

Take a look at http://web.warhound.org/mod_extract_forwarded/ to see how Apache handles this. Basically, you need to add a config file directive listing which hosts (i.e., your proxies and load balancers) are allowed to set X-Forwarded-For.

Yeah, it's still possible to spoof, but it was possible to spoof the incoming IP in the first place.