http - 浏览器不显示 X-Forwarded-For header 的原因

Question

注意:请务必阅读完整问题

我试图理解为什么每次请求页面时浏览器都不向我显示任何 X-Forwarded-For header

顺便说一句，这是我的请求 header 的样子

Request URL:http://localhost:3000/users/sign_in
Request Method:GET
Status Code:304 Not Modified

请求 header :

Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding:gzip,deflate,sdch
Accept-Language:en-GB,en-US;q=0.8,en;q=0.6
Cache-Control:max-age=0
Connection:keep-alive
Cookie:undefined=0; poasterapp=s%3A4faaa6b1723e7c6fbd949083532c52598652547b.sNX%2BKOEed2TEQkQN7I7K5lgpoHMRpwerKFvUegMnTVI; _minerva_session=BAh7CUkiD3Nlc3Npb25faWQGOgZFRkkiJWEyM2Q0ZTViMWEyODBiYmFmODEwZTJhZmUwNWU5ODk5BjsAVEkiE3VzZXJfcmV0dXJuX3RvBjsARiIGL0kiCmZsYXNoBjsARm86JUFjdGlvbkRpc3BhdGNoOjpGbGFzaDo6Rmxhc2hIYXNoCToKQHVzZWRvOghTZXQGOgpAaGFzaHsGOgphbGVydFQ6DEBjbG9zZWRGOg1AZmxhc2hlc3sGOwpJIgAGOwBUOglAbm93MEkiEF9jc3JmX3Rva2VuBjsARkkiMUN0Uk56SXU0dUdIdzgwcFZJM3R0L2N4dlovRllTSGRrQ2o1R0VVanhIaVk9BjsARg%3D%3D--6bd89ce9d29e9bdcf56573f9a153dc663a8fe755
Host:localhost:3000
If-None-Match:"785d34e3998360353567fc710af123fb"
User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.102 Safari/537.36

响应头(不需要但仍然)

Cache-Control:max-age=0, private, must-revalidate
Connection:close
ETag:"785d34e3998360353567fc710af123fb"
Server:thin 1.5.0 codename Knife
Set-Cookie:_minerva_session=BAh7CEkiD3Nlc3Npb25faWQGOgZFRkkiJWEyM2Q0ZTViMWEyODBiYmFmODEwZTJhZmUwNWU5ODk5BjsAVEkiE3VzZXJfcmV0dXJuX3RvBjsARiIGL0kiEF9jc3JmX3Rva2VuBjsARkkiMUN0Uk56SXU0dUdIdzgwcFZJM3R0L2N4dlovRllTSGRrQ2o1R0VVanhIaVk9BjsARg%3D%3D--dfb3ce9f5c97463cfcd0229a133654e6cc606d98; path=/; HttpOnly
X-Request-Id:41a6f3062dc8bc36b7b3eae71dc5075d
X-Runtime:89.238257
X-UA-Compatible:IE=Edge

现在如前所述，我在请求 header 中看不到任何X-Forwarded-For

通读 wiki X-Forwarded-For 的页面让我觉得，它是由缓存服务器完成的(在我的情况下，我相信这是我的 ISP 提供商)所以我可以放心地相信 * *X-Forwarded-For** header 是在缓存服务器端(ISP 提供商)添加的东西

如果是他们是这个烦扰我那么就是

为什么？ 对于在我的机器上本地运行的服务器和我访问它们的服务器来说也是如此(即 X-Forwarded-For 未出现在请求 header 中)通过像 http://localhost:3000

这样的浏览器

Answer 1

X-Forwarded-For 不是 RFC 2616 Section 5.3 中指定的标准请求 header 解决协议(protocol)标准请求 header ，它们是(如 RFC 中指定的)

• 接受
• 接受字符集
• 接受编码
• 接受语言
• 授权
• 期待
• 来自
• 主持人
• 如果匹配
• If-Modified-Since
• 如果不匹配
• 如果范围
• If-Unmodified-Since
• 最大前锋
• 代理授权
• 范围
• 推荐人
• TE
• 用户代理

为了让您的传入请求具有自定义 [X-Forwarded-For] header ，它必须由调用客户端显式添加到该请求中。为什么您没有看到该 header 的最简单解释是发送请求的客户端没有手动添加它。

棘手的是，您期望看到的 header 不是您应该期望收到的 header ，除非您的服务与调用者之间存在契约(Contract)，该契约(Contract)是分开的来自 HTTP 协议(protocol)，表明您应该期望在请求 header 中指定 X-Forwarded-For 值。正如其他人已经指出的那样，XFF header 通常由代理服务器或负载平衡器设置，以指示通过其代理执行操作的真正请求者是谁。

作为服务提供商，如果您要求在所有请求中设置 [X-Forwarded-For] header ，则必须在服务策略级别强制执行。如果您不想为无法识别他们使用代理 IP 屏蔽谁的代理帐户提供服务，请使用 403 Forbidden 退回他们的请求。如果您处于必须为这些请求提供服务但依赖于设置的 header 的情况，那么您将不得不想出一个自定义流程，您可以在其中传达他们的错误。

以下是 HTTP 协议(protocol)关于匿名性的说明:

Because the source of a link might be private information or mightreveal an otherwise private information source, it is stronglyrecommended that the user be able to select whether or not theReferer field is sent. For example, a browser client could have atoggle switch for browsing openly/anonymously, which wouldrespectively enable/disable the sending of Referer and Frominformation.

Clients SHOULD NOT include a Referer header field in a (non-secure)
HTTP request if the referring page was transferred with a secure
protocol.

Authors of services which use the HTTP protocol SHOULD NOT use GET
based forms for the submission of sensitive data, because this will
cause this data to be encoded in the Request-URI. Many existing
servers, proxies, and user agents will log the request URI in some
place where it might be visible to third parties. Servers can use
POST-based form submission instead...

Elaborate user-customized accept header fields sent in every request,in particular if these include quality values, can be used by serversas relatively reliable and long-lived user identifiers. Such useridentifiers would allow content providers to do click-trail tracking,and would allow collaborating content providers to match cross-serverclick-trails or form submissions of individual users. Note that formany users not behind a proxy, the network address of the hostrunning the user agent will also serve as a long-lived useridentifier. In environments where proxies are used to enhanceprivacy, user agents ought to be conservative in offering acceptheader configuration options to end users. As an extreme privacymeasure, proxies could filter the accept headers in relayed requests.General purpose user agents which provide a high degree of headerconfigurability SHOULD warn users about the loss of privacy which canbe involved.

就我个人而言，我会使用 401.2 退回请求，并通过 WWW-Authenticate 响应 header 将请求者路由到质询屏幕，向他们显示不允许匿名访问您网站的通知。这是一种使用 WWW-Authenticate header 的 SCSS 方式，但您似乎希望 X-Forwarded-For header 能够确认并识别真正的请求者并允许公共(public)非匿名访问为您服务。对我来说，这是一个身份验证问题。