Subject: Re: [apps-discuss] WGLC: draft-ietf-appsawg-http-forwarded-02.txt

From: Willy Tarreau <[email-masked]>
Date: Sun, 6 May 2012 08:07:50 +0200

Hi Andreas,

I'd like to propose the following point for "8.1. Header validity and integrity".

  For a long transition period, origin servers will be facing requests
  holding both X-Forwarded-* header fields and the new Forwarded header
  field. The only way to decide which one is the right one cannot be
  determined by any information carried in the request such as the header
  fields presence or order. The only way to know what header to rely on
  depends on the previous trusted proxy or gateway in the chain, and such
  information may only be specified in the origin server's configuration.

  Servers behind a trusted reverse proxy will likely be configured to use
  only one header field. Servers behind multiple trusted reverse proxies
  might be configured to use either header field depending on the incoming
  connection's source address.

I have another point related to this : should we encourage proxies and
gateways to convert X-Forwarded-* header fields from requests to Forwarded
when possible ? It would solve most of the trouble on origin servers during
the transition period I think, at least in hosted environments where the
header field names are all controlled by the same admin.

Regards,
Willy