{"action":"created","issue":{"url":"https://api.github.com/repos/akka/akka/issues/19388","labels_url":"https://api.github.com/repos/akka/akka/issues/19388/labels{/name}","comments_url":"https://api.github.com/repos/akka/akka/issues/19388/comments","events_url":"https://api.github.com/repos/akka/akka/issues/19388/events","html_url":"https://github.com/akka/akka/issues/19388","id":125625089,"number":19388,"title":"Akka Http: Parsing of X-Forwarded-For should avoid DNS lookups if possible","user":{"login":"cmbaxter","id":2078763,"avatar_url":"https://avatars.githubusercontent.com/u/2078763?v=3","gravatar_id":"","url":"https://api.github.com/users/cmbaxter","html_url":"https://github.com/cmbaxter","followers_url":"https://api.github.com/users/cmbaxter/followers","following_url":"https://api.github.com/users/cmbaxter/following{/other_user}","gists_url":"https://api.github.com/users/cmbaxter/gists{/gist_id}","starred_url":"https://api.github.com/users/cmbaxter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cmbaxter/subscriptions","organizations_url":"https://api.github.com/users/cmbaxter/orgs","repos_url":"https://api.github.com/users/cmbaxter/repos","events_url":"https://api.github.com/users/cmbaxter/events{/privacy}","received_events_url":"https://api.github.com/users/cmbaxter/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/akka/akka/labels/3%20-%20in%20progress","name":"3 - in progress","color":"eb6420"},{"url":"https://api.github.com/repos/akka/akka/labels/community-contrib","name":"community-contrib","color":"009800"},{"url":"https://api.github.com/repos/akka/akka/labels/t:http","name":"t:http","color":"CCCCCC"},{"url":"https://api.github.com/repos/akka/akka/labels/t:http:core","name":"t:http:core","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/akka/akka/milestones/74","html_url":"https://github.com/akka/akka/milestones/stream-http-2.0.x","labels_url":"https://api.github.com/repos/akka/akka/milestones/74/labels","id":1497235,"number":74,"title":"stream-http-2.0.x","description":"","creator":{"login":"rkuhn","id":470469,"avatar_url":"https://avatars.githubusercontent.com/u/470469?v=3","gravatar_id":"","url":"https://api.github.com/users/rkuhn","html_url":"https://github.com/rkuhn","followers_url":"https://api.github.com/users/rkuhn/followers","following_url":"https://api.github.com/users/rkuhn/following{/other_user}","gists_url":"https://api.github.com/users/rkuhn/gists{/gist_id}","starred_url":"https://api.github.com/users/rkuhn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rkuhn/subscriptions","organizations_url":"https://api.github.com/users/rkuhn/orgs","repos_url":"https://api.github.com/users/rkuhn/repos","events_url":"https://api.github.com/users/rkuhn/events{/privacy}","received_events_url":"https://api.github.com/users/rkuhn/received_events","type":"User","site_admin":false},"open_issues":5,"closed_issues":2,"state":"open","created_at":"2016-01-11T13:45:35Z","updated_at":"2016-01-20T20:04:14Z","due_on":null,"closed_at":null},"comments":17,"created_at":"2016-01-08T14:46:48Z","updated_at":"2016-01-22T15:07:28Z","closed_at":null,"body":"As mentioned in this forum post:\r\n\r\nhttps://groups.google.com/forum/#!topic/akka-user/e5cl-TjGqNg\r\n\r\nI think it's a good idea to try and avoid DNS lookups when parsing the X-Forwarded-For header.  The InetAddress.getByName method is smart enough to see if the value supplied is an ip vs a host, but if it is a host, it will result in a DNS lookup. For our own purposes, we dispose of hosts in the XFF as we consider that fishy as none of our proxy layers would ever append a host and therefore we throw that component of the XFF out.  I don't know if this will be the case for everyone, so my thinking is that maybe you guys can introduce a setting that controls whether host filtering is done on the XFF header values.  If enabled, then I think a simple filter operation on the list of Strings that can consult a regex or multiple (ipv4, ipv6, ipv6 hex compressed) regexes first to drop items that are not deemed to already be IPs.  It can still use InetAdress.getByName after going through the filtering as you are hedging that you won't get a DNS lookup now because all you have left are IPs.  That would keep things pretty simple as opposed to having to take the next step, which is converting the addresses to Array[Byte] and going through InetAddress.getByAddress instead.\r\n\r\nI played around with this using the following regexes and things worked well:\r\n\r\n      val ipv4 = \"\"\"^(25[0-5]|2[0-4]\\d|[0-1]?\\d?\\d)(\\.(25[0-5]|2[0-4]\\d|[0-1]?\\d?\\d)){3}$\"\"\".r\r\n      val ipv6 = \"^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$\".r\r\n      val ipv6HexComp = \"^((?:[0-9A-Fa-f]{1,4}(?::[0-9A-Fa-f]{1,4})*)?)::((?:[0-9A-Fa-f]{1,4}(?::[0-9A-Fa-f]{1,4})*)?)$\".r"},"comment":{"url":"https://api.github.com/repos/akka/akka/issues/comments/173944647","html_url":"https://github.com/akka/akka/issues/19388#issuecomment-173944647","issue_url":"https://api.github.com/repos/akka/akka/issues/19388","id":173944647,"user":{"login":"cmbaxter","id":2078763,"avatar_url":"https://avatars.githubusercontent.com/u/2078763?v=3","gravatar_id":"","url":"https://api.github.com/users/cmbaxter","html_url":"https://github.com/cmbaxter","followers_url":"https://api.github.com/users/cmbaxter/followers","following_url":"https://api.github.com/users/cmbaxter/following{/other_user}","gists_url":"https://api.github.com/users/cmbaxter/gists{/gist_id}","starred_url":"https://api.github.com/users/cmbaxter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cmbaxter/subscriptions","organizations_url":"https://api.github.com/users/cmbaxter/orgs","repos_url":"https://api.github.com/users/cmbaxter/repos","events_url":"https://api.github.com/users/cmbaxter/events{/privacy}","received_events_url":"https://api.github.com/users/cmbaxter/received_events","type":"User","site_admin":false},"created_at":"2016-01-22T15:07:27Z","updated_at":"2016-01-22T15:07:27Z","body":"@ktoso, sorry I took so long on this.  Was very busy with work.  Here is the PR.  Let me know if I need to change anything:\r\n\r\nhttps://github.com/akka/akka/pull/19584"}}