Trustable X-Forwarded-For in ERP5 SR (!769) · Merge requests · nexedi / slapos

Merged Kazuhiko Shiozaki requested to merge trustable-x-forwarded-for into master May 26, 2020

This MR is for trustable X-Forwarded-For header parameter between frontend and ERP5 SR backend.

backend HTTPd (apache for now) drops X-Forwarded-For header if the incoming connection does not have a valid client certificate.
we can control trustable CAs for client certificate between frontend and backend by frontend-caucase-url-list parameter.
frontend cluster exposes backend-client-cacucase-url parameter that issues client certificates to communicate with backend.

Edited Jun 16, 2020 by Kazuhiko Shiozaki