[ZOOKEEPER-4860] Disable X-Forwarded-For in IPAuthenticationProvider by default

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.9.2
• Fix Version/s: 3.10.0, 3.9.3
• Component/s: security, server
• Labels: pull-request-available
• Assignee: Andor Molnar
• Reporter: Andor Molnar
• Created: 13/Sep/24 20:17
• Updated: 24/Oct/24 20:09
• Resolved: 17/Sep/24 15:38

Description

Disable X-Forwarded-For header check in IPAuthenticationProvider by default to improve reliability in client IP address detection. 

X-Forwarded-For is not a standard header, it's not required and not needed unless ZooKeeper is behind a proxy server. Relying on that when detecting client IP address should be the exception, not the standard behaviour. Therefore we should disable it by defult.

Issue Links

• links to: GitHub Pull Request #2187