envoyproxy / envoyproxy/gateway

Envoy default settings aren't what is expected for an edge proxy

Open
#6,338 16 comments 0 reactions 1 assignee Claimed by @rudrakhp View on GitHub
triage
Dominant language
Go
Stars
3k
Forks
864
Avg merge
2d 2h
Merged PRs (30d)
140

Description

*Description*:

I've started using envoy gateway (1.4.1) as an edge proxy with untrusted clients and I noticed that X-Forwarded-For is showing multiple entries which I wasn't expecting, I expected that the X-Forwarded -For header received from a downstream client would be ignored.

I tried to set
```
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: ClientTrafficPolicy
metadata:
name: client-policy
namespace: infra
spec:
targetRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: public
clientIPDetection:
xForwardedFor:
numTrustedHops: 0
```
But that didn't change the behaviour.

When I look at the config I see

"use_remote_address": false, which I think this is meant to be true by default?

I also see
```
"original_ip_detection_extensions": [
{
"name": "envoy.extensions.http.original_ip_detection.xff",
"typed_config": {
"@type": "type.googleapis.com/envoy.extensions.http.original_ip_detection.xff.v3.XffConfig",
"skip_xff_append": false
}
```
Am I doing something wrong here or is this not quite right?

[optional *Relevant Links*:]
https://github.com/envoyproxy/gateway/issues/1048
https://www.envoyproxy.io/docs/envoy/latest/configuration/best_practices/edge#configuring-envoy-as-an-edge-proxy

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.