Trusted proxies

When the redirection.io agent is used as a reverse proxy, it is usually deployed in front of one or more backend servers. It may also be deployed behind a load balancer or a CDN. In these cases, the agent needs to be configured to trust the proxies that are forwarding the requests to it, in order to correctly identify the client's IP address and other information that may be lost when the request is forwarded to the agent.

The trusted_proxies configuration node allows you to fine-tune the trusted proxies behavior:

• list the IP addresses of the proxies that you want to trust
• specify whether or not to individually trust the Forwarded, X-Forwarded-For, X-Forwarded-Proto and X-Forwarded-Host headers sent by the proxies, which are commonly used to forward the client's IP address and other information

For example, see the following configuration:

instance:
    name: 'My Instance'
reverse_proxy:
    listen:
        - 'tcp://0.0.0.0:80'
    trusted_proxies:
        ips:
            - 192.168.0.0/16
            - 172.16.0.16
        forwarded: true
        x_forwarded_for: true
        x_forwarded_host: false
        x_forwarded_proto: true
    forward:
        address: 'backend:8080'
    agent:
        project_key: my-project-key

With this configuration, the agent will trust the Forwarded and X-Forwarded-For headers that could be passed by the proxies at the IP addresses 172.16.0.16 or in the CIDR range 192.168.0.0/16. It will also trust the X-Forwarded-Proto header, but not the X-Forwarded-Host header.