option forwardfor

[james-d-elliott]

Hey guys, one of the developers of Authelia here.

We have had a user report that the XFF header is not appearing when using this module and option forwardfor. I expect this is a nuance with how that option works and is on haproxy's side and you guys can't do anything about it. But figured I'd ask if you knew how to get this working anyway.

See authelia/authelia#3346

[TimWolla]

But figured I'd ask if you knew how to get this working anyway.

Without testing: It should be possible to http-request set-header x-forwarded-for %[src] before calling haproxy-auth-request. That line should be equivalent for a simple option forwardfor without any other parameters.

[james-d-elliott]

Yep this is probably what we'll update our guide to suggest, as well as an ACL checking if it exists (in which case leaving it alone and using option forwardfor).

[TimWolla]

as well as an ACL checking if it exists (in which case leaving it alone

Not sure if I read that right, but blindly trusting (or suggesting to trust) an existing XFF header might open up the setup to security issues.

That's why you need to explicitly add the if-none parameter to option forwardfor and the documentation also explains the caveat:

Alternatively, the keyword "if-none" states that the header will only be
added if it is not present. This should only be used in perfectly trusted
environment, as this might cause a security issue if headers reaching HAProxy
are under the control of the end-user.

[james-d-elliott]

I'm also aware of this but I appreciate you pointing it out, we don't have an example of removing that yet but it's something that I had planned implementing in all proxy examples via utilizing a file ACL (works well for Cloudflare for example, which also can't be trusted unless you configure a transform rule correctly).

We are going to have to do a mix of ACL's to get this operating safely and in a way that's reliable.

[vtmocanu]

Yes, i confirm this fixes my issue, i put this under the frontend https_front that i was using and i started getting the XFF header.
Thanks @TimWolla and @james-d-elliott !!

[james-d-elliott]

Great this is also the solution we roughly came up with privately in testing. Keep an eye out though because I will be making a significant change to the docs which hopefully addresses this in a more comprehensive yet secure way.