Timeline for Why is my IP address hidden over HTTPS but not HTTP while I'm behind a proxy?
Current License: CC BY-SA 4.0
14 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 29, 2022 at 12:26 | comment | added | Henry Mont | @brynk Well we are using zscaler, and the range of IPs that can be used is huge (the netmask would be 255.255.0.0). And even if I could predict a smaller range, my API provider want the IPs to be owned by us... I'm afraid I will have the same problem with a cloud service provider. I'll try it if nothing else is working out. I will first put some pressure on IT and the API Provider. | |
| Jun 28, 2022 at 18:01 | comment | added | brynk |
if the external ip-addy of the proxy is fixed or in a predictable range, you can have your api provider allow this (instead of your server's ip) - another idea to try may be to use some cloud service-provider endpoint: in my experience these are usually direct (eg. aws-gateway) .. use ctrl+shift+i/ f12/ devtools in your browser and connect to a s3 bucket (or equiv.) and you'll be able to tell the difference between that and an intercepted tx
|
|
| Jun 28, 2022 at 12:48 | comment | added | Henry Mont | @brynk Yes that's what I ended up finding out from my research, I guess this is more secure for the company... But that means I will have to ask IT to set up a routing around the proxy, this will troublesome :'( | |
| Jun 28, 2022 at 12:03 | comment | added | brynk | @henry-mont not being flippant .. these proxies actually perform the request on your behalf as a client, then re-encrypt the data and send it to you to satisfy your query, encrypting the response as if they were the server - to achieve this, they need to instal a root cert into your local host trusted store - when you inspect the api host's certificate in your browser it will be issued by the proxy and signed by the root (not the api server!) .. see: security.stackexchange.com/a/133261 and thesslstore.com/blog/ssl-inspection .. ps. the proxy won't bother the http req. | |
| Jun 28, 2022 at 9:57 | comment | added | Henry Mont | @dave_thompson_085 Yes, it is actually inserting a XFF header, thanks :) But it is indeed useless to me cuz the API won't trust that... | |
| Jun 28, 2022 at 9:43 | comment | added | Henry Mont | @brynk I doubt that IT would install a proxy that let the http requests go through as they please ahah but who knows. So I should check who signed the certificate to see if the proxy has tampered with the http request then ? I'm sorry but I have no idea how to do that, didn't find much online, is it supposed to be in the header ? | |
| Jun 28, 2022 at 1:36 | comment | added | dave_thompson_085 | A traditional 'CONNECT' proxy can't see or modify the content of HTTPS, but many proxies today are 'intercepting' proxies that decrypt and re-encrypt HTTPS, mostly for various kinds of security monitoring like IDS/IPS or DLP; these could add a header, but I don't know if they do. In any case there's no reason for the server to trust a client-side proxy's header. | |
| Jun 27, 2022 at 12:19 | comment | added | brynk | your server configured to use a proxy? it could be one of these that performs your https lookups for you on your behalf, then inspects the data, then re-encrypts and sends you the response? if yes, could that proxy be ignoring your http request because there's no work needed to inspect the traffic? (check the cert in your https response: look at the root cert) | |
| Jun 27, 2022 at 8:55 | comment | added | Henry Mont | I tried accessing it over http and there isn't any X-Forwarded-For header. That would mean the proxy isn't injecting my real IP. So I still don't know how mon-ip.com/en/my-ip is finding my real IP. | |
| Jun 27, 2022 at 8:42 | comment | added | vidarlo | It's not if you access it over https as the proxy can't inject it. | |
| Jun 27, 2022 at 8:30 | comment | added | Henry Mont | Well that is weird, I don't see any X-Forwarded-For header. It doesn't seem like the real IP is being transmitted that way... | |
| Jun 27, 2022 at 8:10 | comment | added | vidarlo | That would normally not be logged. But the configuration will tell you. You can also set up a website that prints the headers. I made a quick one you can check with. | |
| Jun 27, 2022 at 7:56 | comment | added | Henry Mont | So without any access to proxy's logs, I can't see what headers are injected ? | |
| Jun 27, 2022 at 7:41 | history | answered | vidarlo | CC BY-SA 4.0 |