cis-nginx-v300-3-4

name	cis-nginx-v300-3-4
description	Ensure proxies pass source IP information (Manual)
category	cis-nginx
version	3.0
author	cyberstrike-official
tags	["cis","nginx","web-server","reverse-proxy","logging"]
cis_id	3.4
cis_benchmark	CIS NGINX Benchmark v3.0.0
tech_stack	["nginx","linux","web-server"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS 3.4 — Ensure proxies pass source IP information

Profile Applicability

• Level 1 - Proxy
• Level 1 - Loadbalancer

Description

When NGINX acts as a reverse proxy or load balancer, it terminates the client connection and opens a new connection to the upstream application server. By default, the upstream server sees the NGINX server's internal IP address as the source, obscuring the original client IP. Standard HTTP headers like X-Forwarded-For and X-Real-IP must be explicitly configured to pass the original client's IP address and protocol information to the backend application.

Rationale

Visibility of the true client IP address is essential for security auditing, incident response, and access control within the backend application. Without forwarding this information:

1. Forensics: Application logs will show all traffic coming from the NGINX proxy IP, making it impossible to trace malicious activity to a specific attacker.
2. Access Control: Application-level IP allow/deny lists or rate limits will fail or mistakenly block the entire proxy.
3. Compliance: Accurate logging of the user origin is often a regulatory requirement.

Impact

Enabling these headers allows the backend application to see the original client IP. However, if NGINX simply appends to an existing X-Forwarded-For header sent by a malicious client, the backend might be tricked into trusting a spoofed IP at the beginning of the list.

Audit Procedure

1. Verify Configuration:

Check the active configuration for proxy header directives in proxied locations:

nginx -T 2>/dev/null | grep -E "proxy_set_header (X-Real-IP|X-Forwarded-For)"

Evaluation:

• Presence: Verify that proxy_set_header X-Forwarded-For and proxy_set_header X-Real-IP are present in location blocks that use proxy_pass (or grpc_pass, fastcgi_pass).
• Correctness:
  • X-Forwarded-For should typically use $proxy_add_x_forwarded_for (to preserve the chain) or $remote_addr (if NGINX is the first trusted hop).
  • X-Real-IP should use .