Comment by Bender
1 day ago
load balancer / proxy, since you need a way to get the real ip
If it is at all helpful most layer-7 load balancers have an option to enable a header that contains the real IP address, then one need only reconfigure their web daemon to log that header. It's very similar to how CDN's send the real IP in a header.
And it's almost certainly exploitable by a client sending that same header.
Most load balancers will silently drop the real IP address header on the ingress side to avoid exactly what you are describing. That used to be a thing around 2000 - 2001 era. If you find a load balancer with that issue today open a case with their vendor.
Not reliably enough. Look for parser differentials.
2 replies →