MEDIUM6.5
GO-2022-0520
Exposure of client IP addresses in net/http
Quick fix
GO-2022-0520 — stdlib: upgrade to the fixed version with the command below.
go get stdlib@v1.17.12Details
Client IP adresses may be unintentionally exposed via X-Forwarded-For headers.
When httputil.ReverseProxy.ServeHTTP is called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy sets the client IP as the value of the X-Forwarded-For header, contrary to its documentation.
In the more usual case where a Director function sets the X-Forwarded-For header value to nil, ReverseProxy leaves the header unmodified as expected.
Are you affected?
Enter the version of the package you're using.