Windows X-Forwarded-For support

Question asked by Elazar Broad - 12/18/2024 at 10:48 PM

Answered

Hello -

Do the Windows builds support X-Forwarded-For and X-Real-IP? I have Apache in front of SmarterMail on Windows, with Apache proxying requests directly to Kestrel, however, SmarterMail does not recognize these headers and still shows the IP of my proxy as the source IP. I will note that the Windows server running SmarterMail is running a dual IPv4/IPv6 stack, so the IP shows ::ffff:1.2.3.4. Please advise.

Thanks!

5 Replies

Reply to Thread

Elazar Broad Replied

12/27/2024 at 1:37 AM

Bump

Elazar Broad Replied

12/30/2024 at 11:36 PM

After some testing, I've confirmed that the headers are only honored when the proxied request comes from localhost. This is likely due to SmarterMail using the defaults for KnownProxies (see https://learn.microsoft.com/en-us/aspnet/core/host-and-deploy/proxy-load-balancer?view=aspnetcore-8.0#forwarded-headers-middleware-options) or explicitly setting localhost/loopback in KnownProxies.

Would it be possible to add an option to make this configurable? i.e. add additional trusted proxies via appsettings.json?

Thanks,

Elazar

Matt Petty Replied

12/31/2024 at 1:35 PM

Employee Post

Hmm interesting, thanks for looking into this. I tried looking at appsettings.json to see if it'd be possible with no changes on our end, but I looks like we have to still manually set some things in code. I'll add a task to discuss this with the team.

Matt Petty

Senior Software Developer

SmarterTools Inc.

www.smartertools.com

Sébastien Riccio Replied

3/12/2026 at 7:46 PM

Raising this topic from the abysses.

It would be great to be able to declare somewhere, trusted proxies, other than the default 127.0.0.1.

Nowadays It can already be done for TCP proxies, using the Settings -> Security -> Whitelist > TCP Proxy flag, but we are missing a way to allow SM to honor X-Forwarded-* headers from reverse proxies that are not on 127.0.0.1

Thanks :)

Sébastien Riccio

System & Network Admin

https://swisscenter.com

Andrew Barker Replied

Today at 1:20 PM

Employee Post Marked As Answer

Just came across this while going through some of the tasks in our list. In build 9623 from May, the TCP Proxy setting in whitelist settings was renamed "Proxy" and was updated to apply to HTTP requests as well. Since that build, SmarterMail uses whitelist entries with Proxy enabled to walk back through the X-Forwarded-* headers on HTTP requests to better identify the client IP address.

Andrew Barker
Lead Software Developer
SmarterTools Inc.
www.smartertools.com

Back to Community Threads

Please leave this box unchecked

Reply to Thread

Enter the verification text