Can True-Client-IP header evaluation in AccessControl policy be disabled?

[dusan]

According to https://docs.apigee.com/api-platform/reference/policies/access-control-policy, if the API request contains the True-Client-IP header, then the Access Control policy ignores the X-Forwarded-For header completely and evaluates only the IP address in the True-Client-IP header.

This enables clients to easily spoof source IP address just by adding this request header. Is it possible to ignore True-Client-IP header in Access Control policy?

[davidebozza · Accepted solution]

Hello Dusan,

I've been in touch with the Apigee support on the usage of True-Client-IP since several weeks now, and apparently it seems it can be ignored simply enabling the feature.enableMultipleXForwardCheckForACL at organization level.

With this feature enabled Edge seems to ignore the True-Client-IP Header and starts evaluating all the IP's in XFF Header by default.

It is then possible to control the behavior of the Access Control policy using the ValidateBasedOn Element as stated here:
https://docs.apigee.com/api-platform/reference/policies/access-control-policy#validatebasedon

I haven't tested this feature yet, so I can't guarantee it works exactly as stated, but I count to do it ASAP.

During the discussion, and before they provided me the solution of the feature.enableMultipleXForwardCheckForACL, I also proposed Apigee to add a flag in the Acces Control policy, like <EnableTrueClientIpCheck>, by default set to True so to remain backward compatible, which, if set to False, allows the policy to continue using the IP address from the X-Forwarded-For instead of evaluating the True-Client-IP header.

We'll see if this feature request will be accepted.

Hope this helps,

Davide

[dusan]

Thank you for sharing this info David, I will also test this.