Ensure that backend targets receive a trustworthy client source address.
Prevent Forwarded-Header Spoofing
CCC.LB.CN14 · Access
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.LB.CP03 | Layer 7 Routing | The service can distribute incoming traffic based on application layer (OSI layer 7) information. Some of the supported protocols on layer 7 are HTTP/2, HTTP/3, HTTPS, gRPC, and WebSockets. |
| CCC.LB.CP19 | Request and Response Header Transformations | The service can modify HTTP headers of both incoming requests and outgoing responses. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.LB.TH13 | Client Source Address Is Spoofed via Forwarded Headers | Forwarded-for headers supplied by the client may be appended to rather than replaced by the load balancer. Backend targets and downstream access rules that trust these headers then attribute requests to a false source address, allowing IP-based allowlists to be bypassed and access logs to be poisoned. This compromises the confidentiality of protected resources and the integrity of audit records. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.LB.CN14.AR01 | When the load balancer forwards a layer-7 request, client-supplied forwarded-for headers MUST be removed or replaced with the connection source address. | tlp-green, tlp-amber, tlp-red |