http://coldfusion.com logo
Join Slack
Powered by
How do you capture the IP address of the client ma...
# cfml-general
d
How do you capture the IP address of the client making the request? CGI.REMOTE_ADDR is giving me the IP address of the internal network firewall. What is the solution to this scenario?
b
@Daniel Mejia If you're on CommandBox, there is a setting for this
Just only enable it if you trust the proxy or firewall you're behind.
For a non-CommandBox server, you'd need to manually look at the same headers that setting activates
d
trust? its our azure firewall.
b
There maybe a Tomcat valve that does the same thing. I haven't looked
Yes, you "trust" azure in this context
you just don't want to enable that for a server which is directly accessible on the open internet
d
it is accessible on the internet
b
otherwise, a hacker can simply send an 
x-forwarded-for
header claiming they are coming from localhost and then you're settings to block the admin, etc will give them access to everything!
I said "directly" accessible
That word is the important modifier
Directly as in no other proxies, firewalls, or web servers in front
A proxy will generally overwrite any untrusted forwarded headers and replace it with their own
If you just want it for logging, then maybe you just check the header yourself, which is fine
The CommandBox setting will actually swap out the IP that shows in the CGI scope
🧐 1
d
Ok thank you.
e
q
BTW, this HIGHLY depends on your proxy. My F5 adds the header 
x-forwarded-ip
to the request (that we have to pull out manually). When you use AWS's proxy, it is in 
x-remote-user
. Some firewalls/proxies won't pass the external IP along unless you configure it.
b
x-remote-user is something entirely different
That's for authenticated requests
d
Should I assume that our azure firewall is removing the header since I don't see it listed in the cfdump?
b
It's possible it's not setting it. I haven't used Azure enough to know if a setting needs to be ticked for that
But it's generally pretty standard in proxies
What specifically are you dumping?
q
@bdw429s -- oh, that's how it SUPPOSED to be used. But it's an open bucket that gets sent over.
b
It would be under 
getHTTPRequestData().headers
d
Ok I guess I have look at the firewall and configure it to add that header.
b
If this is the Azure firewall you're using, the docs seem to indicate it should be present https://learn.microsoft.com/en-us/azure/firewall/rule-processing
Note
Both HTTP and HTTPS protocols (with TLS inspection) are always filled by Azure Firewall with XFF (X-Forwarded-For) header equal to the original source IP address.
d
looks like Azure Firewall is Layer 4 and I would need a Layer 7 service like Front Door or Web Application Firewall
b
Ahh, that would make sense
layer 4s don't parse the HTTP request or modify it
👍🏾 1
They just pass the packets along basically
d
Uff, from my estimates Azure WAF would cost about $1300 per month.
3 Views
Open in Slack
PreviousNext
Powered by