Lecture 187: X-Forwarded Headers
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：01:55
- 来源：Udemy Lecture 28555997
- Slide 数量：4
- 画面切换：00:35、01:19、01:38
扫描说明
逐条读取了 Udemy 页面中的 46 条英文 Transcript cue，并按时间轴扫描全长约 01:55 的视频。依据 ALB 终止连接后的 Source IP、三类 X-Forwarded Header、适用范围与日志用途、代理链和字段含义划分为 4 个小节。截图均在 Transcript 侧栏关闭、播放器控件隐藏后复核，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. ALB 终止连接后，Target 看到的是 ALB 私网 IP
时间范围：00:00–00:35
总结 / Summary
中文
客户端以 Public IP 通过 HTTPS 连接 Public ALB，ALB 再从 VPC 内的 Private IP 向 EC2 建立后端 HTTP 连接。由于 ALB 在中间终止并重新建立连接，EC2 从网络层看到的 Source IP 是 ALB 的私网地址（示例 10.0.0.25），而不是客户端原始地址。
English
A client with a public IP connects to a public ALB over HTTPS, and the ALB establishes a backend HTTP connection to EC2 from its private VPC address. Because the ALB terminates and recreates the connection, EC2 sees the ALB private address (10.0.0.25 in the example) as the network-layer source, not the original client address.
Transcript
00:00 Okay, so now let's talk
00:01 about the X-Forwarded Headers
00:03 for HTTP requests on your Load Balancers.
00:06 So if we take an example of a client
00:08 which has a public IP,
00:10 connecting to a Load Balancer
00:12 which has well a public IP to be accessible,
00:14 but also a private IP on the VPC,
00:17 then the Load Balancer will connect to EC2 instance.
00:20 The question is:
00:21 what is the IP that the EC2 instance
00:22 we'll see the requests originating from?
00:25 Well, because the ALB has a termination mechanism in place,
00:28 the EC2 instance we'll see traffic originating
00:31 from the IP that is 10.0.0.25.
2. ALB 自动添加 For、Proto 与 Port 信息
时间范围：00:35–01:19
总结 / Summary
中文
为了让应用恢复客户端上下文，ALB 会自动修改 HTTP Header：X-Forwarded-For 保存客户端 Public IP，X-Forwarded-Proto 保存客户端到 ALB 使用的 HTTP 或 HTTPS，X-Forwarded-Port 保存客户端访问 ELB 的端口。应用读取这些字段即可知道请求原始来源与前端连接属性。
English
To preserve client context, the ALB automatically adds HTTP headers: X-Forwarded-For carries the client public IP, X-Forwarded-Proto records HTTP or HTTPS used from client to ALB, and X-Forwarded-Port records the port used to reach the ELB. Applications can read them to recover the request origin and frontend connection properties.
Transcript
00:35 But if the EC2 instance needs to be able
00:37 to identify what is the original IP of the clients
00:41 it can do so by looking at some headers
00:44 that have been added by the ALB automatically.
00:47 So, even though the EC2 instance sees
00:49 the traffic being from this private address of the ALB,
00:53 some headers will be edited by the ALB.
00:55 And it all started with an X-Forwarded prefix.
00:59 And so we have X-Forwarded-For
01:01 which is the public IP of the clients.
01:04 X-Forward-Proto which is a protocol that were used
01:07 by the clients to connect into the ALB,
01:09 and X-Forwarded-Port,
01:11 which was the port used by the client to connect
01:13 into the ALB.
01:14 So using these headers, you're EC2 instance
01:16 can understand where the request came from.
3. 这些非标准 Header 适用于 ALB 和 HTTP/HTTPS CLB
时间范围：01:19–01:38
总结 / Summary
中文
X-Forwarded-* 是非标准 HTTP Header，用于把 Load Balancer 已知的客户端信息传给 Target，并可支持 Server 端访问日志记录。课程指出它们由 ALB，以及工作在 HTTP/HTTPS 模式的 Classic Load Balancer 支持；不要把这一行为直接套用到不解析 HTTP 的四层转发。
English
X-Forwarded-* values are non-standard HTTP headers used to pass client information known by the load balancer to its targets, including for server-side access logging. The course identifies support on ALB and on Classic Load Balancers operating in HTTP/HTTPS mode; do not assume the same behavior for layer-4 forwarding that does not parse HTTP.
Transcript
01:19 So, these are non-standard HTTP headers that are used only
01:22 by the ALB in the CLB.
01:24 And it's used to enhance the request
01:26 and give some information about the clients.
01:29 You can use these to log client requests on your servers.
01:32 And this is supported by the CLB in HTTP and HTTPS mode,
01:36 and the ALB.
4. X-Forwarded-For 可包含以逗号分隔的代理链
时间范围：01:38–01:55
总结 / Summary
中文
X-Forwarded-For 不一定只有一个地址；经过 Proxy 时可形成 Comma-separated IP List，课程强调最左侧通常是原始 Client IP。X-Forwarded-Proto 为 HTTP 或 HTTPS，X-Forwarded-Port 则是连接 ELB 时使用的端口。日志与安全逻辑应正确解析代理链，而不是把整个字段当成单一可信 IP。
English
X-Forwarded-For may contain more than one address. With proxies, it can become a comma-separated IP list, and the course notes that the left-most value is normally the original client IP. X-Forwarded-Proto is HTTP or HTTPS, while X-Forwarded-Port is the port used to connect to the ELB. Logging and security logic should parse the proxy chain correctly rather than treat the whole field as one trusted IP.
Transcript
01:38 So, X-Forwarded-For contains the IP address of the clients.
01:41 And if there are multiple IP addresses,
01:43 it may have a comma in case you're using proxies.
01:46 Proto could be HTTP or HTTPS,
01:48 and a port is a port use to connect to the ELB.
01:51 So that's it for this lecture, I hope you liked it.
01:53 And I will see you in the next lecture.
整讲总结 / Overall Summary
中文
由于 ALB 会终止客户端连接，EC2 看到的 Source IP 是 ALB 私网地址。ALB 通过 X-Forwarded-For、X-Forwarded-Proto 与 X-Forwarded-Port 把原始 IP、协议和端口传给应用；这些 Header 也受 HTTP/HTTPS CLB 支持，可用于日志。遇到代理时，For 字段可能是逗号分隔的 IP 链。
English
Because an ALB terminates the client connection, EC2 sees the ALB private address as the source. The ALB passes the original IP, protocol, and port through X-Forwarded-For, X-Forwarded-Proto, and X-Forwarded-Port; HTTP/HTTPS CLB also supports these headers, which can drive logging. With proxies, the For field may be a comma-separated IP chain.
返回顶部 ↑