microsoft / microsoft/dev-tunnels
Append/Replace Forwarded headers
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 508
- Forks
- 52
- Avg merge
- 20h 6m
- Merged PRs (30d)
- 7
Description
When using dev tunnels with a front end proxy (proxy forwards to devtunnel endpoint which forwards to downstream app), forwarded headers are overwritten instead of appended/replaced.
Example:
Proxy presets these headers for the request forwarded to the devtunnel:
X-Forwarded-For: 127.0.0.1
X-Forwarded-Proto: https
X-Forwarded-Host: localhost:2683
Devtunnel receives request and forwards to downstream application, which receives them as-so:
x-forwarded-for: 10.XXX.XXX.XXX
x-forwarded-proto: https
x-forwarded-host: {TUNNEL_ID}.usw3.devtunnels.ms
As you can see, from the downstream application perspective, there is no way to know the "clients" original HOST information, which could cause issues in application behavior.
Needs confirmation, but I believe per the HTTP spec, the headers should result in something like this (from the downstream application perspective):
x-forwarded-for: 127.0.0.1,10.XXX.XXX.XXX
x-forwarded-proto: https
x-forwarded-host: localhost:2683
It would still probably be useful to pass along the devtunnel HOST information somewhere since the IP is likely dynamic (i.e. perhaps by including non-standard X-Original-* headers: X-Original-For, X-Original-Proto, X-Original-Host). Matter of fact it seems the devtunnel proxy is already making use of x-original-proto, just not the others.
This was briefly touched on in #466, but closed as not planned due to priorities. However, I feel like this is at least something that deserves to be put on a feature roadmap for investigation at least some point in the future. At minimum, the devtunnel proxy needs to somehow pass the original HOST information downstream. These are the kinds of limitations that might keep people using other fleshed out solutions.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files, tests, or entry points. Start by tracing the dev-tunnel proxy's forwarded-header handling and confirm the HTTP forwarding semantics; done means preserving incoming host and forwarded values downstream and deciding how tunnel-origin values are exposed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- networking
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100