Implementing Secure Proxy's HTTP proxying capabilities

This section describes IBM Secure Proxy’s enhanced http proxying capabilities, that allow Secure Proxy to pass requests off to backend http servers for further processing.

IBM Secure Proxy now also includes HTTP host header and client IP address in requests it forwards to the back-end servers to ensure source IP address (of Client) is made available to the backend servers.

Secure Proxy implements this feature in the following two ways:

  • HTTP host header is forwarded in the Forwarded header host field and X-Forwarded-host header.
  • Client IP address is forwarded in the Forwarded header for field and X-Forwarded-For header.

The following section describes how secure proxy adapter adjusts or sets the headers to render Secure Proxy’s proxying capabilities:

Forwarded header

The for, host, by fields in this header value are determined and updated by the Http Proxy Adapter as follows:
  1. The for parameter value is set to the client IP address as determined by the TCP connection.
  2. The by parameter value is set to the host name or IP address as derived from Fully Qualified Domain Name (FQDN) in the SSO properties. If SSO is not configured, the host name or IP value is derived from adapter property proxy.host.name.or.ip. The host parameter is updated with the host header value received from the client
  3. The host parameter value is used in the context of PEM systems and also by servers on the back-end needing to access the actual client IP address.

X-Forwarded-For header

  1. The X-Forwarded-For header value is set to the for parameter value as derived in Forwarded header in step 1.
  2. This accommodates Servers that may not be processed by the Forwarded header.

X-Forwarded-Host

  1. The X-Forwarded-Host header value is set to the host parameter value as derived in Forwarded header in step 1.
  2. This accommodates Servers that may not be processed by the Forwarded header.