The original post: /r/nginx by /u/smalltimesysadmin on 2024-09-13 00:26:42.

TLDR: Is there a way to pass the source IP for a reverse proxy to the upstream host?

I run a password reset tool that’s based on a tomcat stack. I have a nginx server operating as a reverse proxy in front of it. It’s been like that for months without issue. Recently, a specific client has started to use the tool in rapid succession to reset several user accounts. I’m still trying to determine exactly what/how the user is doing it, but it’s causing the password reset tool to semi-crash where the screen to enter a username works, but when you try to progress to the password reset questions, it returns an HTTP 400 error. Restarting the tomcat service restores operation until that specific user tries whatever they’re doing again. I can’t see how it would be an issue, but the logs seem to indicate that user has a pool of IPs their traffic is egressing from.

Digging into the tomcat logs, it looks like I’m running into a URL_ROLLING_THROTTLES_LIMIT_EXCEEDED error. From my understanding, that error is related to a hard-coded limit of around 10 calls per minute. Or maybe not, because tomcat is the most evil and un-troubleshootable tech stack ever… Given that the user is egressing their traffic from a fairly large IP pool, I suspect that the password reset tool is actually seeing the IP of the reverse proxy as the source IP, causing that throttle limit to be triggered.

All that to say, is the operation of the reverse proxy like I think it is, and if so, is there an option I can put in the conf file to cause it to pass the actual source IP from the client to the password reset tool instead of the proxy’s? I’ll post the relevant stanzas from the conf file as soon as I can get access to it. Thank you very much for any help that can be offered!