dev-tunnels icon indicating copy to clipboard operation
dev-tunnels copied to clipboard

Append/Replace Forwarded headers

Open gerneio opened this issue 9 months ago • 0 comments

When using dev tunnels with a front end proxy (proxy forwards to devtunnel endpoint which forwards to downstream app), forwarded headers are overwritten instead of appended/replaced.

Example:

Proxy presets these headers for the request forwarded to the devtunnel:

X-Forwarded-For: 127.0.0.1
X-Forwarded-Proto: https
X-Forwarded-Host: localhost:2683

Devtunnel receives request and forwards to downstream application, which receives them as-so:

x-forwarded-for: 10.XXX.XXX.XXX
x-forwarded-proto: https
x-forwarded-host: {TUNNEL_ID}.usw3.devtunnels.ms

As you can see, from the downstream application perspective, there is no way to know the "clients" original HOST information, which could cause issues in application behavior.

Needs confirmation, but I believe per the HTTP spec, the headers should result in something like this (from the downstream application perspective):

x-forwarded-for: 127.0.0.1,10.XXX.XXX.XXX
x-forwarded-proto: https
x-forwarded-host: localhost:2683

It would still probably be useful to pass along the devtunnel HOST information somewhere since the IP is likely dynamic (i.e. perhaps by including non-standard X-Original-* headers: X-Original-For, X-Original-Proto, X-Original-Host). Matter of fact it seems the devtunnel proxy is already making use of x-original-proto, just not the others.

This was briefly touched on in #466, but closed as not planned due to priorities. However, I feel like this is at least something that deserves to be put on a feature roadmap for investigation at least some point in the future. At minimum, the devtunnel proxy needs to somehow pass the original HOST information downstream. These are the kinds of limitations that might keep people using other fleshed out solutions.

gerneio avatar Jan 15 '25 16:01 gerneio