From f42bbd68418c9ecd1afab3403f27df3b22636c71 Mon Sep 17 00:00:00 2001 From: Francis Lavoie Date: Fri, 11 Mar 2022 01:03:34 -0500 Subject: [PATCH] `trusted_proxies` --- src/docs/markdown/caddyfile/directives/reverse_proxy.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/docs/markdown/caddyfile/directives/reverse_proxy.md b/src/docs/markdown/caddyfile/directives/reverse_proxy.md index ca39862..5d4254c 100644 --- a/src/docs/markdown/caddyfile/directives/reverse_proxy.md +++ b/src/docs/markdown/caddyfile/directives/reverse_proxy.md @@ -85,6 +85,7 @@ reverse_proxy [] [] { max_buffer_size # header manipulation + trusted_proxies [private_ranges] header_up [+|-] [ []] header_down [+|-] [ []] @@ -264,7 +265,6 @@ The proxy can **manipulate headers** between itself and the backend: - **header_up** Sets, adds, removes, or performs a replacement in a request header going upstream to the backend. - **header_down** Sets, adds, removes, or performs a replacement in a response header coming downstream from the backend. - #### Defaults By default, Caddy passes thru incoming headers—including `Host`—to the backend without modifications, with three exceptions: @@ -273,6 +273,8 @@ By default, Caddy passes thru incoming headers—including `Host`—to t - It sets the [X-Forwarded-Proto](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Proto) header field. - It sets the [X-Forwarded-Host](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Host) header field. +For these `X-Forwarded-*` headers, by default, Caddy will ignore their values from incoming requests, to prevent spoofing. If Caddy is not the first server being connected to by your clients (for example when a CDN is in front of Caddy), you may configure `trusted_proxies` with a list of IP ranges (CIDRs) from which incoming requests are trusted to have sent good values for these headers. As a shortcut, `trusted_proxies private_ranges` may be configured to trust all private IP ranges. + Additionally, when using the [`http` transport](#the-http-transport), the `Accept-Encoding: gzip` header will be set, if it is missing in the request from the client. This behavior can be disabled with [`compression off`](#compression) on the transport. #### HTTPS