[ https://issues.apache.org/jira/browse/HDFS-6219?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13969625#comment-13969625 ]
Daryn Sharp commented on HDFS-6219: ----------------------------------- For a pair of entry/exit proxies, the header will not contain the exit proxy since it's the remote address of the request. The header will be: {noformat}X-Forwarded-For: origin_ip, entry_proxy_ip{noformat} I'm not sure if every hop should be checked or it could lead to a lot of configuration updates when proxies are changed. Arguably if you trust a proxy, then you should be able to trust its configuration to only accept other valid clients or proxies. > Proxy superuser configuration should use true client IP for address checks > -------------------------------------------------------------------------- > > Key: HDFS-6219 > URL: https://issues.apache.org/jira/browse/HDFS-6219 > Project: Hadoop HDFS > Issue Type: Sub-task > Components: namenode, webhdfs > Affects Versions: 2.0.0-alpha, 3.0.0 > Reporter: Daryn Sharp > Assignee: Daryn Sharp > Attachments: HDFS-6219.patch > > > Similar to HDFS-6218, the trusted proxies should use X-Forwarded-For when > performing superuser checks so oozie can use webhdfs via a http proxy. -- This message was sent by Atlassian JIRA (v6.2#6252)