apache-backend: discard incoming X-Forwarded-For without valid SSL Client Authentification.

bba044e5 · Kazuhiko Shiozaki · d9ca2e38 · bba044e5
Commit bba044e5 authored May 14, 2020 by Kazuhiko Shiozaki
Show whitespace changes
Inline Side-by-side

Showing with 1 addition and 0 deletions

component/apache/apache-backend.conf.in component/apache/apache-backend.conf.in +1 -0

No files found.
--- a/component/apache/apache-backend.conf.in
+++ b/component/apache/apache-backend.conf.in
@@ -136,6 +136,7 @@ RequestHeader unset Remote-User
 {% if parameter_dict['ca-cert'] -%}
 SSLVerifyClient optional
 RequestHeader set Remote-User %{SSL_CLIENT_S_DN_CN}s
+RequestHeader unset X-Forwarded-For "expr=%{SSL_CLIENT_VERIFY} != 'SUCCESS'"
 SSLCACertificateFile {{ parameter_dict['ca-cert'] }}
 {%   if parameter_dict['crl'] -%}
 SSLCARevocationCheck chain