Proxy headers forwarding in Nginx - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

What is the effect of this Nginx proxy header configuration?

Given this Nginx snippet, what will be the value of the X-Forwarded-For header sent to the backend server?

location / {
  proxy_pass http://backend;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

Nginx

location / {
  proxy_pass http://backend;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

A The header contains the original client IP plus any existing X-Forwarded-For values.

B The header contains only the backend server IP address.

C The header is removed and not sent to the backend.

D The header contains only the IP address of the Nginx proxy server.

💡 Hint

Think about how Nginx appends client IPs to the X-Forwarded-For header.

The variable $proxy_add_x_forwarded_for appends the client IP to any existing X-Forwarded-For header, preserving the chain of IPs through proxies.

❓ Configuration

intermediate

Which configuration correctly forwards the Host header to the backend?

You want the backend server to receive the original Host header from the client. Which proxy_set_header line achieves this?

A proxy_set_header Host $host;

B proxy_set_header Host $http_host;

C proxy_set_header Host $proxy_host;

D proxy_set_header Host $server_name;

💡 Hint

The original Host header is stored in a variable starting with $http_.

The variable $http_host contains the original Host header sent by the client, so forwarding it preserves the original domain requested.

❓ Troubleshoot

advanced

Why does the backend see the wrong client IP when using Nginx as a reverse proxy?

You configured Nginx as a reverse proxy but the backend logs show the Nginx server IP instead of the real client IP. Which is the most likely cause?

A The proxy_pass directive is missing a trailing slash.

B Nginx is not forwarding the Host header correctly.

C The backend is not reading the X-Forwarded-For header sent by Nginx.

D Nginx is caching the responses and not forwarding requests.

💡 Hint

Think about how backend servers get the real client IP behind proxies.

If the backend does not use the X-Forwarded-For header, it will see the proxy server IP as the client IP.

🔀 Workflow

advanced

Order the steps to correctly forward client IP and Host headers in Nginx proxy configuration.

Arrange these configuration steps in the correct order to forward client IP and Host headers to the backend server.

A 4,1,2,3

B 3,2,1,4

C 2,3,1,4

D 1,2,3,4

💡 Hint

Headers must be set before proxy_pass directive.

Nginx processes directives top to bottom; headers must be set before proxy_pass to be forwarded correctly.

✅ Best Practice

expert

Which Nginx configuration snippet best protects against header spoofing when forwarding client IP?

To avoid clients spoofing the X-Forwarded-For header, which configuration is best to ensure the backend receives a trusted client IP?

A proxy_set_header X-Forwarded-For $remote_addr;

B proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

C proxy_set_header X-Forwarded-For $http_x_forwarded_for;

D proxy_set_header X-Forwarded-For '';

💡 Hint

Consider which variable cannot be spoofed by the client.

Using $remote_addr ensures the IP is the immediate client connecting to Nginx, preventing spoofing of X-Forwarded-For by clients.