request help: The X-Forwarded-For header of the request to the upstream cannot be changed

[jagerzhang]

Issue description

For historical reasons, our upstream service uses IP authentication, the real client IP is get from x-forwarded-for header.
Now it needs to be changed to gateway HMAC authentication, so the upstream IP authentication needs to be shielded through the gateway.

I tried to modify x-forwarded-for through proxy rewirte plug-in, but it didn't take effect:

when using the Kong gateway, we changed x-forwarded-for through serverless:

However, I tried in APISIX, but it does not take effect:

attempt 1

"serverless-pre-function": {
      "functions": [
        "return function(conf, ctx) ngx.req.set_header('X-Forwarded-For', 2.2.2.2) end"
      ],
      "phase": "balancer"
    }

attempt 2

"serverless-pre-function": {
      "functions": [
        "return function(ctx)    ctx.upstream_x_forwarded_for = '2.2.2.2'; end"
      ],
      "phase": "balancer"
    }

attempt 3

"serverless-pre-function": {
      "functions": [
        "return function(conf, ctx) local core = require('apisix.core');core.request.set_header(ctx, 'X-Forwarded-For', '2.2.2.2'); end"
      ],
      "phase": "balancer"
    }

Please take a look.

Environment

• apisix version (cmd: apisix version): 2.9
• OS (cmd: uname -a): Docker image
• OpenResty / Nginx version (cmd: nginx -V or openresty -V):
• etcd version, if have (cmd: run curl http://127.0.0.1:9090/v1/server_info to get the info from server-info API): 3.x
• apisix-dashboard version, if have: 2.8

[spacewander]

Currently, we always override the XFF in

apisix/apisix/cli/ngx_tpl.lua

Line 597 in c907ef0

proxy_set_header X-Forwarded-For $var_x_forwarded_for;

.

We can handle it like X-Forwarded-Proto in

apisix/apisix/init.lua

Line 271 in c907ef0

local hdr = core.request.header(api_ctx, "X-Forwarded-Proto")

PR is welcome!

[jagerzhang]

Currently, we always override the XFF in

apisix/apisix/cli/ngx_tpl.lua

Line 597 in c907ef0

proxy_set_header X-Forwarded-For $var_x_forwarded_for;

.
We can handle it like X-Forwarded-Proto in

apisix/apisix/init.lua

Line 271 in c907ef0

local hdr = core.request.header(api_ctx, "X-Forwarded-Proto")

PR is welcome!

Do we need to write a plug-in ourselves?

[shuaijinchao]

Can be handled in this way temporarily

curl -i http://127.0.0.1:9080/apisix/admin/routes/10  -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
{
    "uri": "/test/index.html",
    "plugins": {
        "serverless-pre-function": {
            "phase": "rewrite",
            "functions": [
                "return function(conf, ctx) ngx.var.var_x_forwarded_for = tostring(\"1.1.1.1\") end"
            ]
        }
    },
    "upstream": {
        "type": "roundrobin",
        "nodes": {
            "127.0.0.1:1980": 1
        }
    }
}'

---

[jagerzhang]

Can be handled in this way temporarily

curl -i http://127.0.0.1:9080/apisix/admin/routes/10  -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
{
    "uri": "/test/index.html",
    "plugins": {
        "serverless-pre-function": {
            "phase": "rewrite",
            "functions": [
                "return function(conf, ctx) ngx.var.var_x_forwarded_for = tostring(\"1.1.1.1\") end"
            ]
        }
    },
    "upstream": {
        "type": "roundrobin",
        "nodes": {
            "127.0.0.1:1980": 1
        }
    }
}'

@shuaijinchao
it works for me, tks!

There is only one difference in variable name between Kong gateway and APISIX gateway:
ngx.var.upstream_x_forwarded_for ==> ngx.var.var_x_forwarded_for

[juzn01]

Hi bro, if i want to remove x_forwarded_for header , how i can do ??
thank you.

[bk13699]

36556a37d1264f88cbfdf5f54a368f641e8b65f5

[bk13699]

curl -i http://127.0.0.1:9080/apisix/admin/routes/10 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
{
"uri": "/test/index.html",
"plugins": {
"serverless-pre-function": {
"phase": "rewrite",
"functions": [
"return function(conf, ctx) ngx.var.var_x_forwarded_for = tostring("1.1.1.1") end"
]
}
},
"upstream": {
"type": "roundrobin",
"nodes": {
"127.0.0.1:1980": 1
}
}
}'

[bk13699]

curl -i http://127.0.0.1:9080/apisix/admin/routes/10 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
{
"uri": "/test/index.html",
"plugins": {
"serverless-pre-function": {
"phase": "rewrite",
"functions": [
"return function(conf, ctx) ngx.var.var_x_forwarded_for = tostring("1.1.1.1") end"
]
}
},
"upstream": {
"type": "roundrobin",
"nodes": {
"127.0.0.1:1980": 1
}
}
}'