nginx代理模式下,伪造X-Forwarded-For头的测试
测试环境: nginx+resin
IP: 内网:172.16.100.10
客户端IP:123.123.123.123
测试页面: test.jsp
<%
out.println(“x-forwarded-for: ” + request.getHeader(“x-forwarded-for”));
out.println(“remote hosts: ” + request.getRemoteAddr());
%>
nginx 配置一
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
wget测试
wget -O aa –header=”X-Forwarded-For:192.168.0.1″ “http://2hei.net/test.jsp“
页面返回结果:
x-forwarded-for: 192.168.0.1, 123.123.123.123
remote hosts: 172.16.100.10
curl测试
curl -H “X-Forwarded-For:192.168.0.1” “http://2hei.net/test.jsp“
x-forwarded-for: 192.168.0.1, 123.123.123.123
remote hosts: 172.16.100.10
nginx 配置二
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
wget测试:
wget -O aa –header=”X-Forwarded-For:192.168.0.1″ “http://2hei.net/test.jsp“
页面返回结果:
x-forwarded-for: 123.123.123.123
remote hosts: 172.16.100.10
curl测试
curl -H “X-Forwarded-For:192.168.0.1” “http://2hei.net/test.jsp“
x-forwarded-for: 123.123.123.123
remote hosts: 172.16.100.10
测试结果:
1、配置 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
增加了一个真实ip X-Forwarded-For,并且顺序是增加到了“后面”。
2、配置 proxy_set_header X-Forwarded-For $remote_addr;
清空了客户端伪造传入的X-Forwarded-For,
保证了使用request.getHeader(“x-forwarded-for”)获取的ip为真实ip,
或者用“,”分隔,截取X-Forwarded-For最后的值。
My cousin recommended this blog and she was totally right keep up the fantastic work!
2010-05-31 上午 5:35Great, I never knew this, thanks.
2010-06-05 下午 2:33Genial fill someone in on and this enter helped me alot in my college assignement. Gratefulness you seeking your information.
2010-06-11 上午 11:46This is such a great resource that you are providing and you give it away for free. I enjoy seeing websites that understand the value of providing a prime resource for free. I truly loved reading your post. Thanks!
2010-06-13 上午 11:47It’s posts like this that keep me coming back and checking this site regularly, thanks for the info!
2010-06-14 上午 11:49It is very difficult to find knowledgeable people about this matter, you seem like you know what you are preaching about! Thanks
2011-01-31 下午 10:45