Problem with proxy servers
Kornelis Sietsma <korny-0NacajZNxEFWk0Htik3J/[email protected]> Fri, 14 Jan 2005 12:34:03 +1100
| Newsgroups | gmane.comp.java.securityfilter.user |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --------------090207080400040109070302 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Hi folks, I've been having a problem with an application (xwiki) that uses securityfilter. My work's ISP uses a pool of transparent http proxies for all web access - and each proxy has a different IP address. Unfortunately DefaultSecurityAccessManager uses request.getRemoteAddr() to hash the username and password - which Tomcat returns as the IP address of the proxy server. This means every time I get assigned a new proxy, my username/password hash fails, the authentication fails, and I get logged out. Also, despite some docs on the net indicating that there is a request header "HTTP_X_FORWARDED_FOR" that defines the real IP address I'm coming from, it seems that Tomcat or JK isn't passing that header on - when I dump all my headers, there isn't any such thing: getRemoteAddr: 211.27.91.166 getRemoteHost: 166.060.dsl.mel.iprimus.net.au headers: host: wiki.<my_domain>.net.au user-agent: Mozilla/5.0 (X11; U; Linux i686; rv:1.7.3) Gecko/20040913 Firefox/0.10 accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 accept-language: en-us,en;q=0.5 accept-encoding: gzip,deflate accept-charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 keep-alive: 300 connection: keep-alive cookie: JSESSIONID=C12E349757BEE811E12DC524B0307604; style=default; language=en if-modified-since: Fri, 14 Jan 2005 01:09:15 GMT cache-control: max-age=0 content-length: 0 Any thoughts on this? I can work around it by overriding the SecurityAccessManager and ignoring the IP address entirely, but that won't help others who encounter this problem, and it means losing the IP address check, which seems a handy feature. - Korny -- Kornelis (Korny) Sietsma e korny-0NacajZNxEFWk0Htik3J/[email protected] <mailto:korny-0NacajZNxEFWk0Htik3J/[email protected]> h [email protected] <mailto:[email protected]> m 0421 079 693 HotMagna software solutions 2 Adelaide Street Richmond 3121 Vic Australia flexibility choice freedom --------------090207080400040109070302 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type"> <title></title> </head> <body bgcolor="#ffffff" text="#000000"> Hi folks,<br> <br> I've been having a problem with an application (xwiki) that uses securityfilter.<br> <br> My work's ISP uses a pool of transparent http proxies for all web access - and each proxy has a different IP address. Unfortunately DefaultSecurityAccessManager uses request.getRemoteAddr() to hash the username and password - which Tomcat returns as the IP address of the proxy server.<br> <br> This means every time I get assigned a new proxy, my username/password hash fails, the authentication fails, and I get logged out.<br> <br> Also, despite some docs on the net indicating that there is a request header "HTTP_X_FORWARDED_FOR" that defines the real IP address I'm coming from, it seems that Tomcat or JK isn't passing that header on - when I dump all my headers, there isn't any such thing:<br> <pre id="line19"><span class="comment">getRemoteAddr: 211.27.91.166 getRemoteHost: 166.060.dsl.mel.iprimus.net.au headers: </span><span class="comment"> host: wiki.<my_domain>.net.au user-agent: Mozilla/5.0 (X11; U; Linux i686; rv:1.7.3) Gecko/20040913 Firefox/0.10 accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 accept-language: en-us,en;q=0.5 accept-encoding: gzip,deflate accept-charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 keep-alive: 300 connection: keep-alive cookie: JSESSIONID=C12E349757BEE811E12DC524B0307604; style=default; language=en if-modified-since: Fri, 14 Jan 2005 01:09:15 GMT cache-control: max-age=0 content-length: 0</span> </pre> Any thoughts on this? I can work around it by overriding the SecurityAccessManager and ignoring the IP address entirely, but that won't help others who encounter this problem, and it means losing the IP address check, which seems a handy feature.<br> <br> - Korny<br> <div class="moz-signature">-- <br> <style> body { font-family: Arial; font-size: 10pt; color: #333333; margin: 5px 5px 5px 5px; } a { color: #0D4E7D; } .hot { font-family: Arial Black, Arial; font-weight: normal; color: #C70000; } .magna { font-family: Arial; font-weight: bold; color: #0D4E7D; } .logo { font-size: 24pt; } .catchphrase { font-size: 10pt; font-weight: bold; } .contact { font-size: 8pt; } .icon { font-size: 8pt; font-weight: bold; color:#C70000; text-align:center; width:20; padding-left:2; padding-right:2; } .keywords { font-size: 8pt; font-weight: bold; color: white; padding:0; margin:0; background: #C70000;} </style> <div class="moz-signature"><br> <span class="hot">Kornelis (Korny) Sietsma</span> <br> <span class="icon">e</span> <a href="mailto:korny-0NacajZNxEFWk0Htik3J/[email protected]" class="contact">korny-0NacajZNxEFWk0Htik3J/[email protected]</a> <span class="icon">h</span> <a href="mailto:[email protected]" class="contact">[email protected]</a> <span class="icon">m</span> <span class="contact">0421 079 693 <br> <table cellspacing="0"> <tbody> <tr> <td colspan="3" align="center"><span class="hot logo">Hot</span><span class="magna logo">Magna</span></td> </tr> <tr> <td colspan="3" align="center"><span class="catchphrase">software solutions</span></td> </tr> <tr> <td colspan="3" class="contact">2 Adelaide Street Richmond 3121 Vic Australia</td> </tr> <tr> <td class="keywords" align="left">flexibility</td> <td class="keywords" align="center">choice</td> <td class="keywords" align="right">freedom</td> </tr> </tbody> </table> </span></div> </div> </body> </html> --------------090207080400040109070302-- ------------------------------------------------------- The SF.Net email is sponsored by: Beat the post-holiday blues Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek. It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt