Azure Question posted in
The official documentation to get you started can be found here.

Azure Frontdoor is Overwriting XFF header

I am trying to set up an Azure Front Door before requests reach my api.

The flow I have imagined mydomain.com -> AFD -> fdsub.mydomain.com

If i call fdsub.mydomain.com directly, the XFF looks fine. However, when i go through AFD custom domain, the XFF header is overwritten (i see 2 MS data center ips) and the XFF header that was before the AFD is moved to X-Original-Forwarded-For.

In addition to this, when going through the front door, the x-azure-clientip seems to be set correctly as opposed to the XFF header.

According to the Microsoft documentation, AFD should only append to my XFF and not tinker by removing the original XFF header.

Any help would be deeply appreciated.

Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    I managed to figure out the issue.

    The problem was before the AFD. My Nginx controller and ingress did not have the correct configuration set. Meaning my headers were not being forwarded at all from mydomain.com to AFD.

    I have added: use-forwarded-headers: 'true' to my nginx controller configmap and that seems to have resolved the problem.

    Thanks to this previous post, i managed to get back on track.

    Sorce IP with Azure Front Door and Ingress-nginx


  2. 0

    According to the MS documentation, Azure Front Door should only append to the XFF header and not remove the original XFF header as per this doc

    enter image description here

    It’s possible that the XFF header is being overwritten due to a misconfiguration (2 MS data center ips). You may want to review your Azure Front Door configuration and ensure that it’s set up correctly.

    to set up Azure Front Door, configure it for your API, and ensure that the X-Forwarded-For header is properly appended rather than overwritten

    You can create a backend API App service

    az appservice plan create --name apiAppServicePlan --resource-group arkorg --sku B1 --is-linux
"

    enter image description here

    You now have an API service running on https://fdsub.azurewebsites.net.

    enter image description here

    You can then set up a storage account for storing the diagnostic logs

    enter image description here

    create an Azure Front Door instance that routes traffic to your backend API and configures custom rules for XFF headers.

    enter image description here

    Now that you’ve created the App Service, Azure Front Door, and a storage account for logs, enable Diagnostic Logs for Azure Front Door

    az monitor diagnostic-settings create 
  --name afdDiagnostic 
  --resource "/subscriptions/abcd-efg-hijk-lmnop-qrstuvwxyz/resourceGroups/arkorg/providers/Microsoft.Network/frontDoors/arkoFrontDoor" 
  --logs '[{"category": "FrontdoorAccessLog", "enabled": true}]' 
  --metrics '[{"category": "AllMetrics", "enabled": true}]' 
  --storage-account "/subscriptions/abcd-efg-hijk-lmnop-qrstuvwxyz/resourceGroups/arkorg/providers/Microsoft.Storage/storageAccounts/arkoafdlogs"

    enter image description here

    This will now capture access logs and metrics for Azure Front Door and stores the logs in the storage account (arkoafdlogs).

    Now configure the rules engine to handle X-Forwarded-For Header

    FYI, all these header modifications are only possible with Standard or Premium SKU

    References:

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search