diff --git a/apps/docs/content/guides/networking.mdx b/apps/docs/content/guides/networking.mdx index a478345e..7c416ed6 100644 --- a/apps/docs/content/guides/networking.mdx +++ b/apps/docs/content/guides/networking.mdx @@ -45,7 +45,10 @@ The L7 balancer is **nginx-based**, deployed as 2 HA containers per project. It The balancer forwards client info via standard headers: - **`X-Forwarded-For`** / **`X-Real-IP`** — original client IP -- **`X-Forwarded-Proto`** — `https` (original protocol) +- **`X-Forwarded-Proto`** — original protocol (`http` or `https`) +- **`X-Forwarded-Host`** / **`X-Forwarded-Port`** — original host and port + +These headers are set by the balancer itself (client-sent values are overwritten), and the `Forwarded` and `Proxy` headers are stripped from incoming requests. Your app receives plain HTTP but can inspect these headers for the real client info. diff --git a/apps/docs/content/references/networking/l7-balancer-config.mdx b/apps/docs/content/references/networking/l7-balancer-config.mdx index 40f663bb..e2c5953d 100644 --- a/apps/docs/content/references/networking/l7-balancer-config.mdx +++ b/apps/docs/content/references/networking/l7-balancer-config.mdx @@ -368,6 +368,49 @@ Configure security-related options: **Best Practice:** Keep `server_tokens` disabled to avoid revealing server information. +## Forwarded Headers + +The balancer sets the following headers on every request proxied to your application. They are always set by the balancer itself, overwriting any values sent by the client, so your application can safely trust them: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
HeaderValue
HostHost requested by the client
X-Real-IPClient IP address
X-Forwarded-ForClient IP address appended to any existing chain
X-Forwarded-ProtoProtocol the client used (`http` or `https`)
X-Forwarded-HostHost requested by the client
X-Forwarded-PortPort the client connected to
+ +:::note Security +The `Forwarded` (RFC 7239) and `Proxy` headers are stripped from incoming requests and never reach your application. Configure your framework to read the `X-Forwarded-*` headers above instead. +::: + ## Advanced Routing Features The L7 HTTP Balancer supports sophisticated routing beyond basic domain mapping.