current/doc/source p-config.sgml,2.122,2.123

Update of /cvsroot/ijbswa/current/doc/source
In directory sfp-cvs-1.v30.ch3.sourceforge.com:/tmp/cvs-serv15295/doc/source

Modified Files:
	p-config.sgml 
Log Message:
Document trust-x-forwarded-for


Index: p-config.sgml
===================================================================
RCS file: /cvsroot/ijbswa/current/doc/source/p-config.sgml,v
retrieving revision 2.122
retrieving revision 2.123
diff -C2 -d -r2.122 -r2.123
*** p-config.sgml	22 May 2016 12:41:50 -0000	2.122
--- p-config.sgml	22 May 2016 12:44:02 -0000	2.123
***************
*** 3507,3515 ****
  </sect3>
  
  </sect2>
  
  <!--  ~  End section  ~  -->
  
- 
  <!--   ~~~~~       New section      ~~~~~     -->
  
--- 3507,3589 ----
  </sect3>
  
+ <!--  ~  End section  ~  -->
+ 
+ <sect3 renderas="sect4" id="trust-x-forwarded-for"><title>trust-x-forwarded-for</title>
+ <variablelist>
+  <varlistentry>
+   <term>Specifies:</term>
+   <listitem>
+    <para>
+     Whether or not Privoxy should use IP addresses specified with the X-Forwarded-For header
+    </para>
+   </listitem>
+  </varlistentry>
+  <varlistentry>
+   <term>Type of value:</term>
+   <listitem>
+    <para>
+     <replaceable>0 or one</replaceable>
+    </para>
+   </listitem>
+  </varlistentry>
+  <varlistentry>
+   <term>Default value:</term>
+   <listitem>
+    <para>0</para>
+   </listitem>
+  </varlistentry>
+  <varlistentry>
+   <term>Notes:</term>
+   <listitem>
+    <warning>
+    <para>
+     This is an experimental feature. The syntax is likely to change
+     in future versions.
+    </para>
+    </warning>
+    <para>
+     If clients reach Privoxy through another proxy, for example a load
+     balancer, Privoxy can't tell the client's IP address from the connection.
+     If multiple clients use the same proxy, they will share the same
+     client tag settings which is usually not desired.
+    </para>
+    <para>
+     This option lets Privoxy use the X-Forwarded-For header value as
+     client IP address. If the proxy sets the header, multiple clients
+     using the same proxy do not share the same client tag settings.
+    </para>
+    <para>
+     This option should only be enabled if Privoxy can only be reached
+     through a proxy and if the proxy can be trusted to set the header
+     correctly. It is recommended that ACL are used to make sure only
+     trusted systems can reach Privoxy.
+    </para>
+    <para>
+     If access to Privoxy isn't limited to trusted systems, this option
+     would allow malicious clients to change the client tags for other
+     clients or increase Privoxy's memory requirements by registering
+     lots of client tag settings for clients that don't exist.
+    </para>
+   </listitem>
+  </varlistentry>
+  <varlistentry>
+   <term>Examples:</term>
+   <listitem>
+    <para>
+     <screen>
+       # Allow systems that can reach Privoxy to provide the client
+       # IP address with a X-Forwarded-For header.
+       trust-x-forwarded-for 1
+     </screen>
+    </para>
+   </listitem>
+  </varlistentry>
+ </variablelist>
+ </sect3>
+ 
  </sect2>
  
  <!--  ~  End section  ~  -->
  
  <!--   ~~~~~       New section      ~~~~~     -->
  


------------------------------------------------------------------------------
Mobile security can be enabling, not merely restricting. Employees who
bring their own devices (BYOD) to work are irked by the imposition of MDM
restrictions. Mobile Device Manager Plus allows you to control only the
apps on BYO-devices by containerizing them, leaving personal data untouched!
https://ad.doubleclick.net/ddm/clk/304595813;131938128;j