Option to disable automatic X-Forwarded-For append/add by lextiz · Pull Request #8576 · envoyproxy/gateway

lextiz · 2026-03-23T11:40:56Z

What type of PR is this?

api: add ClientTrafficPolicy option to disable automatic X-Forwarded-For append

What this PR does / why we need it:

This PR adds a new ClientTrafficPolicy option to disable Envoy Gateway’s automatic appending of the downstream address to the X-Forwarded-For header.

Today, EG appends to X-Forwarded-For in both the default HTTP connection manager path and the XFF original IP detection path, without a user-facing way to turn that off. This change exposes a policy-level switch and wires it through to the relevant Envoy settings while preserving existing behavior by default.

The motivation is similar to #8527, which made x-forwarded-host behavior configurable.

Which issue(s) this PR fixes:

No issue exists

Release Notes: Yes

netlify · 2026-03-23T11:41:01Z

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

Name	Link
🔨 Latest commit	`7dac72a`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/69c92c9c596cbc00080c81d8

rudrakhp · 2026-03-24T10:42:50Z

internal/xds/translator/listener.go

 		UseRemoteAddress:              &wrapperspb.BoolValue{Value: useRemoteAddress},
+		SkipXffAppend:                 ptr.Deref(irListener.Headers, ir.HeaderSettings{}).DisableXForwardedFor,


When use_remote_address is true, XFF is already skipped.

And if you are setting it to false for using client ip detection then it should be set in the extension not in HCM

gateway/internal/xds/translator/listener.go

Lines 182 to 187 in 3c2fc03

xffHeaderConfigAny, _ = proto.ToAnyWithValidation(&xffv3.XffConfig{

XffTrustedCidrs: &xffv3.XffTrustedCidrs{

Cidrs: trustedCidrs,

},

SkipXffAppend: wrapperspb.Bool(false),

})

Thanks for the review! I have removed the HCM-level setting entirely and keep SkipXffAppend only in the XFF original IP detection extension config.

codecov · 2026-03-24T14:35:50Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.35%. Comparing base (b1d7302) to head (7dac72a).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8576      +/-   ##
==========================================
+ Coverage   74.29%   74.35%   +0.05%     
==========================================
  Files         243      243              
  Lines       38155    38156       +1     
==========================================
+ Hits        28347    28369      +22     
+ Misses       7815     7799      -16     
+ Partials     1993     1988       -5

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

lextiz · 2026-03-25T08:24:36Z

@rudrakhp Is there a chance that this change would make it to v1.8?

rudrakhp · 2026-03-25T08:46:29Z

internal/ir/xds.go


+	// DisableXForwardedFor controls if Envoy should stop appending the downstream address to
+	// the X-Forwarded-For header. The default is to keep appending the downstream address.
+	DisableXForwardedFor bool `json:"disableXForwardedFor,omitempty" yaml:"disableXForwardedFor,omitempty"`


Suggested change

DisableXForwardedFor bool `json:"disableXForwardedFor,omitempty" yaml:"disableXForwardedFor,omitempty"`

DisableXForwardedForAppend bool `json:"disableXForwardedForAppend,omitempty" yaml:"disableXForwardedFor,omitempty"`

rudrakhp · 2026-03-25T08:50:34Z

internal/xds/translator/listener.go

 			})
 		} else if clientIPDetection.XForwardedFor.NumTrustedHops != nil {
 			xffHeaderConfigAny, _ = proto.ToAnyWithValidation(&xffv3.XffConfig{
 				XffNumTrustedHops: xffNumTrustedHops(clientIPDetection),


Check if this logic in xffNumTrustedHops() is affected by change in appending behavior. For this we can write a E2E test with XFF append disabled and using num trusted hops.

lextiz · 2026-03-27T18:39:01Z

@rudrakhp Could you please approve running the ci-checks?

Signed-off-by: Alexander Bolshakov <lextiz@gmail.com>

rudrakhp

Wondering about the value proposition here. XFF is appended only if XFF settings in client IP detection is set in CTP. You do this only if downstream is trusted and XFF is reliable. If downstream is NOT trusted (assuming that is why you want to skip appending it's IP to the XFF) then why would you trust the XFF header sent by the downstream? There is no point in configuring XFF based client IP detection.
cc: @envoyproxy/gateway-maintainers

lextiz · 2026-03-29T18:02:22Z

@rudrakhp @Ido-Itz One of the use cases could be using Envoy as egress: outbound traffic to external destinations in some cases should be free of information like internal pod IPs.

@rudrakhp The conformance and e2e failures seem to be flaky issues, seen in main and other PRs.

lextiz requested a review from a team as a code owner March 23, 2026 11:40

lextiz force-pushed the disable-forwarded-for branch 6 times, most recently from b5eb4b4 to 54a782c Compare March 23, 2026 14:55

zirain force-pushed the disable-forwarded-for branch from 54a782c to 0eb05e9 Compare March 24, 2026 01:04

lextiz force-pushed the disable-forwarded-for branch from 0eb05e9 to 2856c19 Compare March 24, 2026 08:48

rudrakhp reviewed Mar 24, 2026

View reviewed changes

lextiz force-pushed the disable-forwarded-for branch from 2856c19 to e4673e9 Compare March 24, 2026 13:17

lextiz force-pushed the disable-forwarded-for branch from e4673e9 to 1e26506 Compare March 24, 2026 15:20

rudrakhp reviewed Mar 25, 2026

View reviewed changes

lextiz force-pushed the disable-forwarded-for branch 3 times, most recently from 64a8de7 to 8634dde Compare March 25, 2026 11:29

lextiz force-pushed the disable-forwarded-for branch from 8634dde to e23f9f1 Compare March 29, 2026 13:30

Add ClientTrafficPolicy XFF append disable support

7dac72a

Signed-off-by: Alexander Bolshakov <lextiz@gmail.com>

lextiz force-pushed the disable-forwarded-for branch from e23f9f1 to 7dac72a Compare March 29, 2026 13:43

rudrakhp reviewed Mar 29, 2026

View reviewed changes

		UseRemoteAddress: &wrapperspb.BoolValue{Value: useRemoteAddress},
		SkipXffAppend: ptr.Deref(irListener.Headers, ir.HeaderSettings{}).DisableXForwardedFor,

	xffHeaderConfigAny, _ = proto.ToAnyWithValidation(&xffv3.XffConfig{
	XffTrustedCidrs: &xffv3.XffTrustedCidrs{
	Cidrs: trustedCidrs,
	},
	SkipXffAppend: wrapperspb.Bool(false),
	})

	DisableXForwardedFor bool `json:"disableXForwardedFor,omitempty" yaml:"disableXForwardedFor,omitempty"`
	DisableXForwardedForAppend bool `json:"disableXForwardedForAppend,omitempty" yaml:"disableXForwardedFor,omitempty"`

Conversation

lextiz commented Mar 23, 2026

Uh oh!

netlify bot commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

Uh oh!

rudrakhp Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

rudrakhp Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

rudrakhp Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

lextiz Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

lextiz commented Mar 25, 2026

Uh oh!

rudrakhp Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

lextiz Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

rudrakhp Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lextiz Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

lextiz commented Mar 27, 2026

Uh oh!

rudrakhp left a comment

Choose a reason for hiding this comment

Uh oh!

lextiz commented Mar 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

netlify bot commented Mar 23, 2026 •

edited

Loading

codecov bot commented Mar 24, 2026 •

edited

Loading

rudrakhp Mar 25, 2026 •

edited

Loading