On Tue, Jun 7, 2011 at 4:21 PM, 杨镭 <span dir="ltr"><<a href="mailto:clanherb@gmail.com">clanherb@gmail.com</a>></span> wrote:<br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Hi:<div><br></div><div>When duplicate http headers occur(e.g., two X-Forwarded-For headers), nginx will use the first instance silently. This means internal variables like $http_x_forwarded_for is not entirely <i>correct,</i> users have to capture packets in the network layer to find out the truth. This is a lot of inconvenient compared to customize log format.</div>
<div><br></div><div>Also, for headers like "X-Forwarded-For", attackers can intentionaly inject serveral spoofed ip addresses.</div><div><br></div><div>Although nginx cannot possibly known which one is more important than the others, it MAY alert user by logging "duplicated headers detected, header:value1, value2, ... value N".</div>
<div><br></div></blockquote><div><br></div><div>It is not a matter of "knowing which is more important", the spec is clear which headers can be repeated and which are invalid, and for this header repeating it is invalid. You should make sure you filter any headers you are using internally like X-Forwarded-For anyway as a security measure...</div>
<div><br></div><div><br></div></div>