Questions about X-forwarded-for in the presence of Squids and CDNs and Browsers

Question

I am trying to understand what the value of X-forwarded-for really means? By definition, it's value will be of the form: ip1, ip2, .... ipn.

The situation I am thinking of is this- I am seeing these XFF values at Squid and requests to squid are coming from a CDN. And the CDN is in-turn requesting content on behalf of a user (browser)

My specific questions are:

1. Does XFF contain the Browser's IP address?
2. If so, which one of the XFF value parts is it?
3. Is the XFF value representing the entire path taken by the request from the browser to the Squid box?
4. If not, what part of the path does it represent?

I went through the definition of XFF on Wiki amd Squid Doc, but it is still not clear to me what would happen in such a situation.

Thanks

Answer 1

Generally each proxy "hop" appends the client IP to X-Forwarded-For, although it's a non-standard header so everything below here relies on your CDN implementing it the same way as everybody else :)

A couple of examples - first, a browser connecting directly to the CDN:

Browser   -> CDN     -> Squid   -> App
1.1.1.1      2.2.2.2    3.3.3.3    10.1.2.3

In this case, the app would see X-Forwarded-For: 1.1.1.1, 2.2.2.2. Simple - the browser is the left-most entry. But consider the case where the browser is behind an ISP or corporate proxy:

Browser      -> Proxy   -> CDN     -> Squid   -> App
192.168.0.25    4.5.6.7    2.2.2.2    3.3.3.3    10.1.2.3

Depending on the proxy configuration, the app might see any of:

• X-Forwarded-For: 4.5.6.7, 2.2.2.2 (if the proxy hides the internal IP)
• X-Forwarded-For: 192.168.0.25, 4.5.6.7, 2.2.2.2 (if the proxy forwards the internal IP)
• X-Forwarded-For: 9.8.7.6, 4.5.6.7, 2.2.2.2 (if the proxy fakes the internal IP)

As you can see, you can't rely on the left-most entry containing a useful browser address. Instead, start from the right and work backwards until you find an address that isn't Squid or the CDN - that'll be your best guess at the browser's address (and also happens to be the remote address you'd see if there was no CDN or Squid).