首页 > nginx, OpenSource > nginx代理模式下,伪造X-Forwarded-For头的测试

nginx代理模式下,伪造X-Forwarded-For头的测试

2010年3月18日

测试环境: nginx+resin
IP: 内网:172.16.100.10

客户端IP:123.123.123.123

测试页面: test.jsp
<%
out.println(“x-forwarded-for: ” + request.getHeader(“x-forwarded-for”));
out.println(“remote hosts: ” + request.getRemoteAddr());
%>

nginx 配置一
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

wget测试
wget -O aa –header=”X-Forwarded-For:192.168.0.1″ “http://2hei.net/test.jsp
页面返回结果:
x-forwarded-for: 192.168.0.1, 123.123.123.123
remote hosts: 172.16.100.10

curl测试
curl -H “X-Forwarded-For:192.168.0.1” “http://2hei.net/test.jsp
x-forwarded-for: 192.168.0.1, 123.123.123.123
remote hosts: 172.16.100.10

nginx 配置二
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

wget测试:
wget -O aa –header=”X-Forwarded-For:192.168.0.1″ “http://2hei.net/test.jsp
页面返回结果:
x-forwarded-for: 123.123.123.123
remote hosts: 172.16.100.10

curl测试
curl -H “X-Forwarded-For:192.168.0.1” “http://2hei.net/test.jsp
x-forwarded-for: 123.123.123.123
remote hosts: 172.16.100.10

测试结果:
1、配置  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
增加了一个真实ip X-Forwarded-For,并且顺序是增加到了“后面”。

2、配置  proxy_set_header X-Forwarded-For $remote_addr;
清空了客户端伪造传入的X-Forwarded-For,
保证了使用request.getHeader(“x-forwarded-for”)获取的ip为真实ip,
或者用“,”分隔,截取X-Forwarded-For最后的值。

分类: nginx, OpenSource 标签:
  1. 2010年5月31日05:35 | #1

    My cousin recommended this blog and she was totally right keep up the fantastic work!

  2. 2010年6月5日14:33 | #2

    Great, I never knew this, thanks.

  3. 2010年6月11日11:46 | #3

    Genial fill someone in on and this enter helped me alot in my college assignement. Gratefulness you seeking your information.

  4. 2010年6月13日11:47 | #4

    This is such a great resource that you are providing and you give it away for free. I enjoy seeing websites that understand the value of providing a prime resource for free. I truly loved reading your post. Thanks!

  5. 2010年6月14日11:49 | #5

    It’s posts like this that keep me coming back and checking this site regularly, thanks for the info!

  6. 2011年1月31日22:45 | #6

    It is very difficult to find knowledgeable people about this matter, you seem like you know what you are preaching about! Thanks

本文的评论功能被关闭了.