Stuart,
my thoughts for an API for this are along the lines of a mechanism to
specify what the standard methods should return plus extra methods to make
precise enquiries. Something like a <proxy> web.xml element which could be:
- unset, gives the current container configuration returns from
getRemoteXxx and getLocalXxx methods.
- NONE, methods always return the details of the real TCP connection to
the app server
- LAST, the methods always returns the details of last proxy (from
either PROXY protocol, Forwarded header or X-Forwarded header - container
config chooses which are supported). This is least likely to be spoofed
by a client if the last proxy always sets the header.
- CLOSEST, the methods always return the details of the rightmost proxy
indicator. This will often be the same as LAST, except for the Forwarded
protocol which allows aggregation of the various parameters so LAST and
CLOSEST can be distinguished.
- FIRST, the methods always return the details of the first proxy
indicator. This is very susceptable to being spoofed by a client.
- FURTHEST, the methods always return the details of the leftmost proxy
indicator. This will often be the same as FIRST, except for the Forwarded
protocol which allows aggregation of the various parameters so FIRST and
FURTHEST can be distinguished.
This element would allow an application to declare what it expects the
normal methods to return.
We could then also have additional methods like
enum ProxyType { NONE, LAST, CLOSEST, FURTHEST, FIRST };
InetSocketAddress getLocalSocketAddress(ProxyType proxy);
InetSocketAddress getRemoteSocketAddress(ProxyType proxy);
String getProtocol(ProxyType proxy);
boolean isSecure(ProxyType proxy);
I would expect a common configuration might be <proxy>FURTHEST</proxy> so
the default methods would return the adjusted values. Then any code that
wants to do things for DoS protection would use
getRemoteSocketAddress(ProxyType.NONE) if standalone or
getRemoteSocketAddress(ProxyType.LAST) if behind a known proxy.
The containers would then be free to use any of the defacto and/or standard
methods to provide the actual values transparently to the webapp, the app
is only saying which of the values it wants/expects to see.
cheers
--
Greg Wilkins <gregw@webtide.com> CTO http://webtide.com