NAME

Plack::Middleware::ForwardedHeaders - Use headers from reverse proxy

SYNOPSIS

use Plack::Builder;
builder {
    enable 'ForwardedHeaders';
    $app;
};

DESCRIPTION

Uses forwarded headers to determine remote IP address, HTTPS status, and requested host. It will adjust the REMOTE_ADDR, HTTP_HOST, and psgi.url_scheme environment items accordingly.

WARNING: Enabling this middleware without a reverse proxy or a properly configured list of trusted proxies will allow users to spoof their IP address.

CONFIGURATION

trusted

An IP address or an array reference of IP addresses of trusted proxies. If set, the forwarded headers will only be used if the request comes from one of the addresses listed as trusted.

use_host

If set, forwarded headers will be used to determine the host being requested. Defaults to false.

use_scheme

If set, forwarded headers will be used to determine the URL scheme. Defaults to true.

use_address

If set, forwarded headers will be used to determine the client address. Defaults to true.

resolve_host

If set, the hostname of the client will be resolved and saved in the REMOTE_HOST. Defaults to false.

HTTP HEADERS

Host Headers

The folling headers are used to determine the original requested host for a forwarded request.

X-Forwarded-Host

Set by Apache 2.2

Remote Address Headers

The folling headers are used to determine the remote IP address for a forwarded request.

X-Forwarded-For

The de-facto standard for finding the originating client IP address. Set by Squid, Apache 2.2, and many others.

X-Real-IP

Used by nginx.

Scheme Headers

The folling headers are used to determine the forwarded scheme:

X-Forwarded-Proto

X-Forwarded-SSL

X-Forwarded-Scheme

Front-End-HTTPS

Used by Microsoft Internet Security and Acceleration Server

SEE ALSO

http://en.wikipedia.org/wiki/X-Forwarded-For

AUTHOR

Graham Knop <haarg@haarg.org>

LICENSE

Copyright (c) 2010, Graham Knop

This library is free software; you can redistribute it and/or modify it under the same terms as Perl 5.10.0. For more details, see the full text of the licenses in the directory LICENSES.