Proxy headers forwarding in Nginx - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

What is the effect of this Nginx proxy header configuration?

Given this Nginx snippet, what will be the value of the X-Forwarded-For header sent to the backend server?

location / {
  proxy_pass http://backend;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

Nginx

location / {
  proxy_pass http://backend;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

A The header contains the original client IP plus any existing X-Forwarded-For values.

B The header contains only the backend server IP address.

C The header is removed and not sent to the backend.

D The header contains only the IP address of the Nginx proxy server.

💡 Hint

Think about how Nginx appends client IPs to the X-Forwarded-For header.

The variable $proxy_add_x_forwarded_for appends the client IP to any existing X-Forwarded-For header, preserving the chain of IPs through proxies.

❓ Configuration

intermediate

Which configuration correctly forwards the Host header to the backend?

You want the backend server to receive the original Host header from the client. Which proxy_set_header line achieves this?

A proxy_set_header Host $host;

B proxy_set_header Host $http_host;

C proxy_set_header Host $proxy_host;

D proxy_set_header Host $server_name;

💡 Hint

The original Host header is stored in a variable starting with $http_.

The variable $http_host contains the original Host header sent by the client, so forwarding it preserves the original domain requested.

❓ Troubleshoot

advanced

Why does the backend see the wrong client IP when using Nginx as a reverse proxy?

You configured Nginx as a reverse proxy but the backend logs show the Nginx server IP instead of the real client IP. Which is the most likely cause?

A The proxy_pass directive is missing a trailing slash.

B Nginx is not forwarding the Host header correctly.

C The backend is not reading the X-Forwarded-For header sent by Nginx.

D Nginx is caching the responses and not forwarding requests.

💡 Hint

Think about how backend servers get the real client IP behind proxies.

If the backend does not use the X-Forwarded-For header, it will see the proxy server IP as the client IP.

🔀 Workflow

advanced

Order the steps to correctly forward client IP and Host headers in Nginx proxy configuration.

Arrange these configuration steps in the correct order to forward client IP and Host headers to the backend server.

A 4,1,2,3

B 3,2,1,4

C 2,3,1,4

D 1,2,3,4

💡 Hint

Headers must be set before proxy_pass directive.

Nginx processes directives top to bottom; headers must be set before proxy_pass to be forwarded correctly.

✅ Best Practice

expert

Which Nginx configuration snippet best protects against header spoofing when forwarding client IP?

To avoid clients spoofing the X-Forwarded-For header, which configuration is best to ensure the backend receives a trusted client IP?

A proxy_set_header X-Forwarded-For $remote_addr;

B proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

C proxy_set_header X-Forwarded-For $http_x_forwarded_for;

D proxy_set_header X-Forwarded-For '';

💡 Hint

Consider which variable cannot be spoofed by the client.

Using $remote_addr ensures the IP is the immediate client connecting to Nginx, preventing spoofing of X-Forwarded-For by clients.

Practice

1. What is the main purpose of using proxy_set_header in an nginx proxy configuration?

easy

A. To cache static files on the proxy server

B. To block client requests based on IP address

C. To compress responses from the backend server

D. To forward original client information like IP and Host to the backend server

Solution

1. Step 1: Understand proxy_set_header role

   The directive proxy_set_header is used to set or override HTTP headers sent to the backend server.

2. Step 2: Identify what headers are forwarded

   It forwards client info such as IP address, Host, and protocol to help backend servers process requests correctly.

3. Final Answer:

   To forward original client information like IP and Host to the backend server -> Option D

4. Quick Check:

   proxy_set_header forwards client info = D [OK]

Hint: Remember proxy_set_header sends client info to backend [OK]

Common Mistakes:

• Thinking it blocks requests
• Confusing it with caching or compression
• Assuming it modifies client requests directly

2. Which of the following is the correct syntax to forward the original client IP address in nginx proxy configuration?

easy

A. proxy_set_header X-Real-IP $proxy_addr;

B. proxy_pass_header X-Real-IP $remote_addr;

C. proxy_set_header X-Real-IP $remote_addr;

D. proxy_forward_header X-Real-IP $remote_addr;

Solution

1. Step 1: Identify correct directive for setting headers

   The correct directive to set headers in nginx proxy is proxy_set_header.

2. Step 2: Use correct variable for client IP

   The variable $remote_addr holds the original client IP address.

3. Final Answer:

   proxy_set_header X-Real-IP $remote_addr; -> Option C

4. Quick Check:

   proxy_set_header + $remote_addr = B [OK]

Hint: Use proxy_set_header with $remote_addr for client IP [OK]

Common Mistakes:

• Using wrong directive like proxy_pass_header
• Using $proxy_addr which is invalid
• Confusing proxy_set_header with proxy_forward_header

3. Given this nginx proxy snippet:

location /api/ {
  proxy_pass http://backend;
  proxy_set_header Host $host;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

What will be the value of the X-Forwarded-For header sent to the backend if the client IP is 192.168.1.10 and the header already contains 10.0.0.1?

medium

A. 192.168.1.10

B. 10.0.0.1, 192.168.1.10

C. 10.0.0.1

D. $proxy_add_x_forwarded_for

Solution

1. Step 1: Understand $proxy_add_x_forwarded_for variable

   This variable appends the client IP to the existing X-Forwarded-For header, separated by a comma.

2. Step 2: Combine existing and client IP

   Since the header already has 10.0.0.1, and client IP is 192.168.1.10, the result is "10.0.0.1, 192.168.1.10".

3. Final Answer:

   10.0.0.1, 192.168.1.10 -> Option B

4. Quick Check:

   $proxy_add_x_forwarded_for appends IP = C [OK]

Hint: Remember $proxy_add_x_forwarded_for appends client IP [OK]

Common Mistakes:

• Assuming it replaces the header instead of appending
• Confusing $proxy_add_x_forwarded_for with $remote_addr
• Expecting only client IP without existing values

4. You configured nginx proxy with:

proxy_set_header X-Forwarded-Proto $scheme;

But the backend always receives http even when client uses https. What is the likely cause?

medium

A. nginx is not configured to listen on HTTPS, so $scheme is always http

B. proxy_set_header syntax is incorrect

C. Backend server ignores X-Forwarded-Proto header

D. You must use $https variable instead of $scheme

Solution

1. Step 1: Understand $scheme variable behavior

   $scheme reflects the protocol used by the client to connect to nginx (http or https).

2. Step 2: Check nginx HTTPS configuration

   If nginx is not listening on HTTPS, all requests come as http, so $scheme is always "http".

3. Final Answer:

   nginx is not configured to listen on HTTPS, so $scheme is always http -> Option A

4. Quick Check:

   $scheme depends on nginx listener protocol = A [OK]

Hint: Check if nginx listens on HTTPS for $scheme to be https [OK]

Common Mistakes:

• Thinking proxy_set_header syntax is wrong
• Assuming backend ignores header without checking
• Using $https variable which is not standard

5. You want to forward the original client IP, host, and protocol to your backend server behind nginx proxy. Which complete configuration snippet correctly forwards these headers?

hard

A. proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;

B. proxy_set_header X-Real-IP $proxy_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $https;

C. proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $proxy_host;
proxy_set_header X-Forwarded-Proto $scheme;

D. proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $http_scheme;

Solution

1. Step 1: Verify variables for client IP, host, and protocol

   $remote_addr is client IP, $host is original host header, and $scheme is protocol (http or https).

2. Step 2: Check each option for correctness

   proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto $scheme; uses correct variables and syntax. Others use invalid variables like $proxy_addr, $proxy_host, or $http_scheme which do not exist.

3. Final Answer:

   proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto $scheme; -> Option A

4. Quick Check:

   Use $remote_addr, $host, $scheme for forwarding headers = A [OK]

Hint: Use $remote_addr, $host, and $scheme for correct forwarding [OK]

Common Mistakes:

• Using non-existent variables like $proxy_addr or $proxy_host
• Confusing $https with $scheme
• Missing one or more headers to forward