Skip to content

Fix extraction of IPv6 addresses from "Forwarded" header field

IPv6 addresses in the "Forwarded" header field are not only enclosed by double quotes, but also by square brackets (*). Those need to be removed as well before attempting to extract the actual IPv6 address.

Currently, extraction of an IPv6 address from a "Forwarded" header field always fails with RFC-compliant "Forwarded" header fields (**). This affects e.g. access control, rate limiting, and logging.

* This is in contrast to the "X-Forwarded-For" header field, where neither quotes nor brackets are used with IPv6 addresses.

** See the examples in RFC 7239, which e.g. Apache Traffic Server 8.1.7 adheres to.

Merge request reports