Plugin: X-Forwarded-For edit

Use this plugin if you are detecting incorrect forwarding IP addresses in your analytics or IP restrictions. This plugin can be used to remove some IP addresses from the X-Forwarded-For header of HTTP search requests.

Historically, the client’s remote address has been used as their IP address, however if the request has passed through any proxies then this header carries the IP address of the last proxy rather than the client’s originating address, resulting in the wrong IP address being recorded.

he X-Forwarded-For HTTP header is used to get around this problem. The X-Forwarded-For header contains a list of IP addresses recording the various hops that the request went through before reaching the search server.

In a complex scenario, a request can go through multiple hops:

When looking at the X-Forwarded-For header value, the first IP address will be the one closer to the client

In the example below:

the X-Forwarded-For header would have 3 values:

Another example is when Funnelback is put behind a content delivery network such as Akamaï:

In all these cases it is desirable to only retain the IP address of the original client to ensure accurate analytics. Funnelback has partial support for this with logging.ignored_x_forwarded_for_ranges that will cause the last IP address (load balancer → backend server) to be scrubbed. Multiple IP addresses may remain however and there’s no easy way to control which one should be kept.

For the example, in the Akamaï case, it would not be practical to configure all the possible IP addresses of Akamaï (hundreds) to be ignored. A better approach instead is to simply ignore the last X-Forwarded-For value and consider the one before last, as it will be the one of the client that issued the request to Akamaï.

Use this plugin when an intermediate network hop gets included in the X-Forwarded-For header resulting in an incorrect value being detected for the remote user’s IP address.

An incorrect X-Forwarded-For value can result in the incorrect operation of features that are based on the user’s IP address including:

In this example, a client require passes through a proxy with IP address 2.2.2.2. This is logged alongside the client’s actual IP address.

To keep only the first IP address from the X-Forwarded-For header for search requests, set:

which will result in the X-Forwarded-For header for a search request being modified from:

to

This results in the detect IP for features like search analytics and curator being based of the 1.1.1.1 IP address.