Rails, Spring and Jetty trust Forwarded headers proxies often ignore
Original title: Forwarded Without Question: How Web Frameworks Overtrust the Forwarded Header
If a proxy only rewrites X-Forwarded-* headers, a client-supplied Forwarded value can override client IP, host and scheme.
A developer testing Envoy found that many proxies, CDNs and load balancers leave the RFC 7239 Forwarded header untouched while rewriting X-Forwarded-* fields. Rails, Jetty, Spring Boot with Reactor Netty, and Symfony read Forwarded in default-ish configurations and can prefer it over proxy-set X-Forwarded-* values. That lets an untrusted client spoof the client IP, hostname or protocol, which the author links to access-control bypass, rate-limit evasion, password-reset host deception and web cache poisoning. The post advises dropping untrusted proxy headers and aligning trusted-proxy lists.
Unconfirmed: Findings come from the author's docs review and local echo apps; no CVE or confirmed attacks are stated.
- Rails, Jetty, Spring Boot, Reactor Netty and Symfony parse Forwarded by default.
- Most reverse proxies and CDNs do not strip incoming Forwarded headers.
- Spoofed for=, host= and proto= can override proxy-generated X-Forwarded-* values.
- Trusted-proxy IP checks fail when the proxy itself forwards the client header.
- Author recommends proxies drop untrusted Forwarded and X-Forwarded-* headers.
Impact: Spoofed client IP, hostname or scheme behind a proxy
| Product | Affected |
|---|---|
| Ruby on Rails | default configuration |
| Eclipse Jetty | default configuration |
| VMware Spring Boot | default configuration |
| Symfony | — |
- 1.Configure proxies to drop untrusted Forwarded and X-Forwarded-* headers.
- 2.Align application trusted-proxy settings with the headers the proxy actually sets.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 1.2.3.4 | though the proxy server reports the correct remote address 1.2.3.4 in X-Forwarded-For . Forwarded header with spoofed contents |
From the original article
14 min read at lkoskela.fiAt work, I was recently testing and deploying a new HTTPS reverse proxy service. I ran into some weirdness in how Envoy handles the X-Forwarded-For headers when it's configured not to trust the incoming values. I ended up configuring Envoy to just drop all incoming X-Forwarded-* and Forwarded headers, just to be safe.
By lkoskela.fi via cameron · lkoskela.fi
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.