[
Date Prev][
Date Next][
Thread Prev][
Thread Next][
Date Index][
Thread Index]
[
List Home]
|
Re: [jetty-users] NAT with HTTP 1.0 returns internal IP address
|
On 04/04/2013 09:15 AM, martijn.list wrote:
I hope you can help me with this minor problem.
If Jetty is installed on a server with a NAT'd IP address, connecting
with HTTP 1.0 returns the internal IP address. This is understandable
since HTTP 1.0 does not support the Host parameter. However it's not
clear to me how to solve this.
Some suggestions that I have found, suggest to set the "hostHeader" on
the connector but this also requires that "forwarded" is set which is
not what I want since I do not want to support forwarding, I only want
to override what's returned by "ServletRequest#getServerName()" if using
HTTP 1.0 (or if the Host attribute is missing).
Two questions:
1. Can I completely disable support for HTTP 1.0 (probably not). The
main reason for this request is that sometimes clients do not want to
"leak" the internal IP address if using NAT and for normal use.
2. Can I set a connection attribute which overrides the default
"ServletRequest#getServerName()" if using HTTP 1.0 or if the Host
parameter is not set?
Since I didn't get any answer, it might be that I have not been clear
enough what the problem is I'm trying to fix.
To illustrate my point I'll provide an example of the "HTTP 1.0 shows
the internal IP address" problem.
Connect with telnet to a Jetty server on port 89 (in this example I use
www.webtide.com) issue a GET with the HTTP 1.0 protocol:
telnet www.webtide.com 80
Trying 72.32.76.94...
Connected to www.webtide.com.
Escape character is '^]'.
GET index.html HTTP/1.0
HTTP/1.1 302 Found
Location: https://192.168.100.94:443index.html
Content-Length: 0
Server: Jetty(9.0.1-SNAPSHOT)
Connection closed by foreign host.
The Location header in the HTTP response tells me to connect to an
internal IP address 192.168.100.94. There are two problems with this:
1. Since it's an internal IP address, connecting to this address will
never work from outside
2. The internal IP address is "leaked". Some companies with strict
security regulations do not like the internal IP addresses to be
"leaked" to the outside.
With Tomcat, you can set the proxyName which is used with HTTP 1.0.
I have two questions which I hope someone can help me with:
1. Can I completely disable support for HTTP 1.0. The
main reason for this request is that sometimes clients do not want to
"leak" the internal IP address if using NAT and for normal use.
2. Can I set a connection attribute which overrides the default
"ServletRequest#getServerName()" if using HTTP 1.0 or if the Host
parameter is not set?
Kind regards,
Martijn Brinkers
