当前位置: 首页 > nginx, OpenSource > 正文

nginx代理模式下,伪造X-Forwarded-For头的测试

测试环境: nginx+resin
IP: 内网:172.16.100.10

客户端IP:123.123.123.123

测试页面: test.jsp
<%
out.println(“x-forwarded-for: ” + request.getHeader(“x-forwarded-for”));
out.println(“remote hosts: ” + request.getRemoteAddr());
%>

nginx 配置一
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

wget测试
wget -O aa –header=”X-Forwarded-For:192.168.0.1″ “http://2hei.net/test.jsp
页面返回结果:
x-forwarded-for: 192.168.0.1, 123.123.123.123
remote hosts: 172.16.100.10

curl测试
curl -H “X-Forwarded-For:192.168.0.1” “http://2hei.net/test.jsp
x-forwarded-for: 192.168.0.1, 123.123.123.123
remote hosts: 172.16.100.10

nginx 配置二
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

wget测试:
wget -O aa –header=”X-Forwarded-For:192.168.0.1″ “http://2hei.net/test.jsp
页面返回结果:
x-forwarded-for: 123.123.123.123
remote hosts: 172.16.100.10

curl测试
curl -H “X-Forwarded-For:192.168.0.1” “http://2hei.net/test.jsp
x-forwarded-for: 123.123.123.123
remote hosts: 172.16.100.10

测试结果:
1、配置  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
增加了一个真实ip X-Forwarded-For,并且顺序是增加到了“后面”。

2、配置  proxy_set_header X-Forwarded-For $remote_addr;
清空了客户端伪造传入的X-Forwarded-For,
保证了使用request.getHeader(“x-forwarded-for”)获取的ip为真实ip,
或者用“,”分隔,截取X-Forwarded-For最后的值。

本文固定链接: https://2hei.net/nginx-x-forwarded-for.html | 二黑的站点

该日志由 2hei 于2010年03月18日发表在 nginx, OpenSource 分类下,
原创文章转载请注明: nginx代理模式下,伪造X-Forwarded-For头的测试 | 二黑的站点
关键字:

nginx代理模式下,伪造X-Forwarded-For头的测试:目前有6 条留言

  1. My cousin recommended this blog and she was totally right keep up the fantastic work!

    2010-05-31 上午 5:35
  2. Great, I never knew this, thanks.

    2010-06-05 下午 2:33
  3. 4楼
    WP Themes:

    Genial fill someone in on and this enter helped me alot in my college assignement. Gratefulness you seeking your information.

    2010-06-11 上午 11:46
  4. 地板
    school grants:

    This is such a great resource that you are providing and you give it away for free. I enjoy seeing websites that understand the value of providing a prime resource for free. I truly loved reading your post. Thanks!

    2010-06-13 上午 11:47
  5. It’s posts like this that keep me coming back and checking this site regularly, thanks for the info!

    2010-06-14 上午 11:49
  6. 沙发
    Emory:

    It is very difficult to find knowledgeable people about this matter, you seem like you know what you are preaching about! Thanks

    2011-01-31 下午 10:45