Bug#425008: apache2: handle X-FORWARDED-FOR by default

To: "Loic Dachary" <loic@debian.org>, 425008@bugs.debian.org
Subject: Bug#425008: apache2: handle X-FORWARDED-FOR by default
From: "Stefan Fritsch" <sf@sfritsch.de>
Date: Fri, 18 May 2007 15:43:10 +0200 (CEST)
Message-id: <[🔎] 21427.217.111.53.98.1179495790.squirrel@eru.sfritsch.de>
Reply-to: "Stefan Fritsch" <sf@sfritsch.de>, 425008@bugs.debian.org
In-reply-to: <[🔎] 87veeqxpnr.fsf@call.dachary.org>
References: <[🔎] 87veeqxpnr.fsf@call.dachary.org>

> +SetEnvIfNoCase X-Forwarded-For "." from_proxy=1

This is horribly insecure for normal setups without proxy. Any client
could set X-Forwarded-For and modify the logged IP address.

Reply to:

Follow-Ups:
- Bug#425008: apache2: handle X-FORWARDED-FOR by default
  - From: Loic Dachary <loic@dachary.org>

References:
- Bug#425008: apache2: handle X-FORWARDED-FOR by default
  - From: Loic Dachary (OuoU) <loic@debian.org>

Prev by Date: Bug#425008: apache2: handle X-FORWARDED-FOR by default
Next by Date: Bug#425008: apache2: handle X-FORWARDED-FOR by default
Previous by thread: Bug#425008: apache2: handle X-FORWARDED-FOR by default
Next by thread: Bug#425008: apache2: handle X-FORWARDED-FOR by default
Index(es):
- Date
- Thread