Merge pull request #4495 from terraincognita07/backport-v2-balancer-forward-x-real-ip

🐛 fix(proxy): backport BalancerForward X-Real-IP overwrite fix to v2

Author: ReneWerner87

docs/api/middleware/proxy.md

@@ -122,7 +122,7 @@ app.Use(proxy.Balancer(proxy.Config{
         "http://localhost:3003",
     },
     ModifyRequest: func(c *fiber.Ctx) error {
-        c.Request().Header.Add("X-Real-IP", c.IP())
+        c.Request().Header.Set("X-Real-IP", c.IP())
         return nil
     },
     ModifyResponse: func(c *fiber.Ctx) error {

middleware/proxy/proxy.go

@@ -261,7 +261,7 @@ func BalancerForward(servers []string, clients ...*fasthttp.Client) fiber.Handle
 		if !strings.HasPrefix(server, "http") {
 			server = "http://" + server
 		}
-		c.Request().Header.Add("X-Real-IP", c.IP())
+		c.Request().Header.Set("X-Real-IP", c.IP())
 		return Do(c, server+c.OriginalURL(), clients...)
 	}
 }

middleware/proxy/proxy_test.go

@@ -740,3 +740,30 @@ func Test_Proxy_Balancer_Forward_Local(t *testing.T) {
 
 	utils.AssertEqual(t, string(b), "forwarded")
 }
+
+// go test -run Test_Proxy_Balancer_Forward_OverwritesXRealIP
+func Test_Proxy_Balancer_Forward_OverwritesXRealIP(t *testing.T) {
+	t.Parallel()
+
+	const (
+		spoofedIP       = "10.0.0.1"
+		appTestClientIP = "0.0.0.0"
+	)
+
+	_, addr := createProxyTestServerIPv4(t, func(c *fiber.Ctx) error {
+		value := c.Get("X-Real-IP")
+		utils.AssertEqual(t, appTestClientIP, value)
+		utils.AssertEqual(t, false, value == spoofedIP)
+		return c.SendStatus(fiber.StatusOK)
+	})
+
+	app := fiber.New()
+	app.Use(BalancerForward([]string{addr}))
+
+	req := httptest.NewRequest(fiber.MethodGet, "/", nil)
+	req.Header.Set("X-Real-IP", spoofedIP)
+
+	resp, err := app.Test(req)
+	utils.AssertEqual(t, nil, err)
+	utils.AssertEqual(t, fiber.StatusOK, resp.StatusCode)
+}