Merge pull request #4260 from gofiber/fix-x-real-ip-header-handling-in-balancerforward

Author: ReneWerner87

docs/middleware/proxy.md

@@ -126,7 +126,7 @@ app.Use(proxy.Balancer(proxy.Config{
         "http://localhost:3003",
     },
     ModifyRequest: func(c fiber.Ctx) error {
-        c.Request().Header.Add("X-Real-IP", c.IP())
+        c.Request().Header.Set("X-Real-IP", c.IP())
         return nil
     },
     ModifyResponse: func(c fiber.Ctx) error {

middleware/proxy/proxy.go

@@ -279,7 +279,7 @@ func BalancerForward(servers []string, clients ...*fasthttp.Client) fiber.Handle
 		if !strings.HasPrefix(server, "http") {
 			server = "http://" + server
 		}
-		c.Request().Header.Add("X-Real-IP", c.IP())
+		c.Request().Header.Set("X-Real-IP", c.IP())
 		return Do(c, server+c.OriginalURL(), clients...)
 	}
 }

middleware/proxy/proxy_test.go

@@ -985,6 +985,32 @@ func Test_Proxy_Balancer_Forward_Local(t *testing.T) {
 	require.Equal(t, "forwarded", string(b))
 }
 
+func Test_Proxy_Balancer_Forward_OverwritesXRealIP(t *testing.T) {
+	t.Parallel()
+
+	const (
+		spoofedIP       = "10.0.0.1"
+		appTestClientIP = "0.0.0.0"
+	)
+
+	_, addr := createProxyTestServerIPv4(t, func(c fiber.Ctx) error {
+		value := c.Get("X-Real-IP")
+		require.Equal(t, appTestClientIP, value)
+		require.NotEqual(t, spoofedIP, value)
+		return c.SendStatus(fiber.StatusOK)
+	})
+
+	app := fiber.New()
+	app.Use(BalancerForward([]string{addr}))
+
+	req := httptest.NewRequest(fiber.MethodGet, "/", http.NoBody)
+	req.Header.Set("X-Real-IP", spoofedIP)
+
+	resp, err := app.Test(req)
+	require.NoError(t, err)
+	require.Equal(t, fiber.StatusOK, resp.StatusCode)
+}
+
 func Test_Proxy_Immutable(t *testing.T) {
 	t.Parallel()