Re: [squid-users] x-forwarded-for Fail

On 11/10/2013 2:44 a.m., merc1984_at_f-m.fm wrote:
>> HTML is a different story entirely from HTTP.
>> Manipuation of HTTP headers on every relay point they cross is mandatory.
> Why?
>

a) Because HTML is a markup language for text documents. HTTP is a
protocol for software communication.

b) Being a communication protocol headers in HTTP are used for the
purpose of negotiating features used to deliver messages by each end of
a particular connection.

Given a proxy chain A <-> B <-> C <-> D. The client connection into a
proxy (A->B) usually has different features to the outgoing server
connection (B->C). The HTTP headers need to be changed from negotiating
(A<->B) mechanisms to (B<->C) mechanisms, things like the message
encoding or whether .
Some features like the much maligned Via and X-Forwarded-For relay
information from B through C, so that A<->D mechanisms work - usually
access control mechanisms for X-Forwarded-For, Via signals min/max
available HTTP version or presence of non-HTTP protocols that affect
end-to-end capabilities.

Amos
Received on Fri Oct 11 2013 - 00:48:49 MDT