Azure load-balanced set preserves client IP

Question

From experimenting with Azure load-balancing set, it seems that x-forwarded-for header is not used (as it would be expected in regular load-balancer), rather they preserve the original client IP.

E.g.:

app.get('/my-ip', function(req, res) {
    winston.log('/my-ip', 'x-forwarded', req.headers['x-forwarded-for'] || 'none', 'remoteAddress', req.connection.remoteAddress || 'none');
    res.end();
});

With the result:

/my-ip x-forwarded none remoteAddress MY_CORRECT_IP

Can this behavior be confirmed and relied upon?

Answer 1

You are confusing proxies with load balancing. Proxies use x-forwarded, load balancers do not (by default). Load balancers work at a lower level in the OSI stack (although you might find all kinds of things calling themselves load balancers that really aren't).

The key difference here is that a proxy actually interprets your HTTP request, typically caching it in the process, before forwarding it with it's altered headers. A load balancer doesn't have to (though it can). They just re-route packets. Some more advanced load balancers support adding this header, but it's never the default configuration. Proxies typically have this header on by default, and support removing it.

The reason load balancers don't typically need this header is that a load balancer is basically a router, as such it maintains the original source ip information of the packets by default. A proxy, on the other hand acts as destination for the original request, then it issues a new request to the new destination, thus the original packet information is typically lost. Like, if you worked at a mail forwarding facility, and you opened peoples mail, read it, then put it in a new envelope with your return address.