Caddy: Proxy preset "transparent" should use X-Forwarded-For

[cederberg]

The new proxy transparent preset is defined to used X-Real-IP, but should probably use X-Forwarded-For instead. Wikipedia actually has great docs for this: https://en.wikipedia.org/wiki/X-Forwarded-For

Same goes for the docs example that currently recommends X-Real-IP.

Weirdly, Nginx seems to default to X-Real-IP. No reason stated though. And a quick googling shows that X-Real-IP has caused lots of confusion and config errors. Should be avoided.

[mholt]

I'll look into this -- also what is @captncraig's feedback? (author of the realip plugin)

[stp-ip]

We could go the save route and enable both on "transparent". People concerned about the additional bandwidth of an additional header could just fallback to their own headers.

[abiosoft]

I also favour having both X-Forwarded-For and X-Real-IP.

[cederberg]

Both seems safe until you read this:
http://relistan.com/http-header-hell-starring-x-real-ip-and-x-forwarded-for/

Other stories as well. Think the standard is better in this case.

[stp-ip]

That should in my opinion not prevent us from using both as default.

[elcore]

:+1: for both

[captncraig]

I am ok with setting both, but I am not ok with trusting either as the remote address on incoming requests. Anybody can set that header and there is no way to authenticate it unless it is coming from a proxy you expect and trust. Thats why I made the real-ip module.

[mholt]

Okay, consensus, great. :smile: I'll change it to set both headers. Thanks for making the real-ip module @captncraig!