Skip to content

fix: parse forwarded header lists#1944

Merged
Eugeny merged 2 commits into
warp-tech:mainfrom
immanuwell:fix-forwarded-header-lists
May 19, 2026
Merged

fix: parse forwarded header lists#1944
Eugeny merged 2 commits into
warp-tech:mainfrom
immanuwell:fix-forwarded-header-lists

Conversation

@immanuwell

@immanuwell immanuwell commented May 17, 2026

Copy link
Copy Markdown
Contributor

Handles comma-separated X-Forwarded-* values when trusted headers are on. Multi-hop proxies do this IRL, AWS ALB appends XFF by default, so yep this is reachable.

Repro:

  1. set http.trust_x_forwarded_headers: true
  2. send a request with X-Forwarded-Host: public.example, proxy.local, X-Forwarded-Proto: https, http, or X-Forwarded-For: 203.0.113.10, 10.0.0.2
  3. before this, Warpgate used the whole list. proto could fail parsing and host/logs got messy, not great tbh
  4. now it uses the first non-empty value and falls back when the trusted header is empty

Tests: cargo test -p warpgate-common-http; cargo clippy -p warpgate-common-http --all-targets -- -D warnings; cargo fmt --check --package warpgate-common-http

Related: #882, #921, #886

@Eugeny Eugeny merged commit edea9a7 into warp-tech:main May 19, 2026
18 checks passed
@Eugeny

Eugeny commented May 19, 2026

Copy link
Copy Markdown
Member

Thank you! @all-contributors please add @immanuwell for code

@allcontributors

Copy link
Copy Markdown
Contributor

@Eugeny

I've put up a pull request to add @immanuwell! 🎉

captain686 pushed a commit to captain686/warpgate that referenced this pull request May 29, 2026
Co-authored-by: Eugene <inbox@null.page>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants