new Cloudflare checkings fail if X-Forwarded-For/Via is spoofed. In addition sites discontinue to load with it, e.g. https://www.daz3d.com/forums/discussion/235556/mud-shaders . Problem: currently X-Forwarded-For/Via are both send with the same IP, although X-Forwarded-For should describe the client, while Via should describe the proxy.
Hi,
new Cloudflare checkings fail if X-Forwarded-For/Via is spoofed. In addition sites discontinue to load with it, e.g. https://www.daz3d.com/forums/discussion/235556/mud-shaders . Problem: currently X-Forwarded-For/Via are both send with the same IP, although X-Forwarded-For should describe the client, while Via should describe the proxy.
However, the new standard header is forwarded and it's suggested to replace X-Forwarded-For/Via with Forwarded: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Forwarded
Would be awesome if this could be included in Chameleon.
EDIT: more & more standard application use forwarded instead of x-forwarded-*, e.g. HAProxy https://github.com/haproxy/haproxy/issues/575