passing remote IP address instead of replacing it

remote IP address

[hotwater]

I have a webserver running apache that forwards requests to an Oracle application server running on a different machine. The REMOTE_ADDR ip address always comes through as the IP address of the webserver machine, instead of the original client's IP address. I need the original on the app server so I can prevent IP Hopping (which can be used to clone a session). Can anyone help me?

I'm running Redhat Linux 2.4.2-2 if that helps. I'm not sure how to check the Apache version. It's actually Oracle's HTTP Server, an extension to Apache: [orafaq.com...]

[jdMorgan]

hotwater,

Welcome to WebmasterWorld!

Not my area of expertise, but you might be able to append the originating IP as a query string to the request, and then use CustomLog on the back-end to "fix" the log files.

I'm thinking of using mod_rewrite to proxy the request through to the back-end, with %{REMOTE_ADDR} added to the query string.

Jim

[hotwater]

Thanks for the suggestion, Jim, we'll give it a try.

[jd01]

I don't know too much about this one either, but SOP for proxy passing of IP is in the header.

You should be able to accomplish this by appending an X-Forwarded-For header to the string being sent and then set your second server to accept the X-Forwarded-For as the IP.

There is some information at perl.apache.org and you will find much more in a search.

Hope this gives you an idea.

Justin

Added: You could probably actually append and use any string you like since X-Forwarded-For is one of the ways people can spoof their IP.

[longjohn]

Hi hotwater,
if i'm not wrong you are using a reverse proxy in front of your Oracle AS.
If correctly configured the reverse proxy passes the browser's IP to the AS via the http-header "x-forwarded-for". This means that in any (pl/sql) application you need to check the variable x-forwarded-for and not the remote_addr variable (and you have to configure AS to include this new environment variable for the developer's use).
On the other hand, if you want the backend-server's logs to trace the browser's ip you need to install rpaf_module (http://stderr.net/apache/rpaf/). I think it's quite unlikely that you can do it on oracle's apache, but if so let us know.