For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

shaggy's avatar
shaggy
Icon for Nimbostratus rankNimbostratus
Dec 31, 2014

Check to make sure they did not enable x-forwarded-for on the HTTP F5 virtual server that the application uses. If you enable HTTPS in drupal only when the x-forwarded-for header is set, then enabling x-forwarded-for on the http virtual server on the f5 (which is a normal thing to do) could cause undesirable application effects

 

Also, as I am unfamiliar with drupal, what does "$_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https'" do? the contents of a legitimate x-forwarded-for header will never contain the text "https"