apache-backend: discard incoming X-Forwarded-For without valid SSL Client Authentification.

a1f502b0 · Kazuhiko Shiozaki · 1c4d1452 · a1f502b0
Commit a1f502b0 authored May 14, 2020 by Kazuhiko Shiozaki
Hide whitespace changes
Inline Side-by-side

Showing with 1 addition and 0 deletions

component/apache/apache-backend.conf.in component/apache/apache-backend.conf.in +1 -0

No files found.
--- a/component/apache/apache-backend.conf.in
+++ b/component/apache/apache-backend.conf.in
@@ -136,6 +136,7 @@ RequestHeader unset Remote-User
 {% if parameter_dict['ca-cert'] -%}
 SSLVerifyClient optional
 RequestHeader set Remote-User %{SSL_CLIENT_S_DN_CN}s
+RequestHeader unset X-Forwarded-For expr="%{SSL_CLIENT_VERIFY} != 'SUCCESS'"
 SSLCACertificateFile {{ parameter_dict['ca-cert'] }}
 {%   if parameter_dict['crl'] -%}
 SSLCARevocationCheck chain