All the traffic gets to the IIS server through a proxy, I cant block or white list IPs, because all the traffic comes from the proxy's IP, Can I use the X-Forwarded-For header with IIS?
I would proceed with caution using a HTTP header for IP filtering considering they can be controlled by the client unless your webserver takes this in account when it forwards your request.
What happens if I as not authorized send X-Forwarded-For in my headers? Will your webserver add an extra X-Forwarded-For? Will it add it below or above mine? Which one will the IIS use to validate on?
These are questions you need to be able to answer before implementing any trust in the header value.
Edit: I dont know of a better alternative, but if you are going for the one you're question you should be able to answer the questions first. I am not talking about passing through multiple proxies, but instead what happens if I put my own X-Forwarder-For header on the bottom of my request? Will your proxy add another one further up? Will there be two X-Forwarder-For? Which one will the webserver look at?
|show 1 more comment|
Windows server 2012 can.