apache-backend: discard incoming X-Forwarded-For without valid SSL Client Authentification.

921a98a0 · Kazuhiko Shiozaki · 5038709b · 921a98a0
Commit 921a98a0 authored May 14, 2020 by Kazuhiko Shiozaki
Hide whitespace changes
Inline Side-by-side

Showing with 1 addition and 0 deletions

component/apache/apache-backend.conf.in component/apache/apache-backend.conf.in +1 -0

No files found.
--- a/component/apache/apache-backend.conf.in
+++ b/component/apache/apache-backend.conf.in
@@ -136,6 +136,7 @@ RequestHeader unset Remote-User
 {% if parameter_dict['ca-cert'] -%}
 SSLVerifyClient optional
 RequestHeader set Remote-User %{SSL_CLIENT_S_DN_CN}s
+RequestHeader unset X-Forwarded-For "expr=%{SSL_CLIENT_VERIFY} != 'SUCCESS'"
 SSLCACertificateFile {{ parameter_dict['ca-cert'] }}
 {%   if parameter_dict['crl'] -%}
 SSLCARevocationCheck chain