Subject: Re: [apps-discuss] WGLC: draft-ietf-appsawg-http-forwarded-02.txt

From: Willy Tarreau <[email-masked]>
Date: Wed, 2 May 2012 07:41:03 +0200

Hi,

On Wed, May 02, 2012 at 09:33:53AM +1000, Mark Nottingham wrote:
> HTTP folk,
> 
> Please have a look at this document and send along comments, especially if you're an intermediary or firewall person, or consume the existing X-Forwarded-For header.
> 
> <http://tools.ietf.org/html/draft-ietf-appsawg-http-forwarded-02>

A quick note before it escapes my mind, for 8.2. Information leak :

I would add :
   This header field must never be copied into response messages by origin
   servers or intermediaries for whatever reason as it can reveal the whole
   proxy chain to the client. As a side effect, special care must be taken
   in hosting environments not to allow the TRACE request where the Forwarded
   field is used, as it would appear in the body of the response message.

Regards,
Willy

---

From: Andreas Petersson <[email-masked]>
Date: Fri, 4 May 2012 11:09:07 +0200

On Wed, 2 May 2012 07:41:03 +0200
>    field is used, as it would appear in the body of the response message.

Seems reasonable. 

Regards
  Andreas