On 4/1/20 2:16 PM, Arturo Borrero Gonzalez wrote:

Hi there!

If you use a CloudVPS web proxy, this email is for you. Toolforge developers/users can ignore this email.

We are introducing a change to eliminate the 'X-Forwarded-For' HTTP header that the CloudVPS web proxy adds when forwarding the HTTP request to your instance. This header contains the original IP address of the internet client that sent the request. This is private information that we would like to reduce in our environment [0].

You use the web proxy if you have a public web endpoint hosted in CloudVPS under the wmflabs.org domain. These are generally configured using Horizon in the DNS

...

Web Proxies section.

Examples of web proxy names:

• accounts.wmflabs.org
• glampipe.wmflabs.org
• incubator.wmflabs.org

Full list can be seen in the Openstack Browser tool [1].

We are ready to introduce this change [2], but wanted to give some heads up for projects that do require this information for whatever reason. We would like to hear from you in the next couple of weeks. Please contact us in the phabricator task [0] and include some rationale why you need the XFF header.

This is the timeline this change will follow:

• 2020-04-01: this email, start collecting list of things that require XFF
• 2020-04-07: start evaluating list of things that require XFF
• 2020-04-15: introduce the change, with proper case whitelisting

When the change is introduced, in two weeks from now, proxy backends that were not whitelisted will stop receiving the XFF header.

Please reach out for any questions or comments.

regards.

[0] https://phabricator.wikimedia.org/T135046 [1] https://openstack-browser.toolforge.org/project/project-proxy [2] https://gerrit.wikimedia.org/r/c/operations/puppet/+/583098

Hi there!

This change is being applied now!

regards.