diff --git a/server/core/src/https/mod.rs b/server/core/src/https/mod.rs index ed431e5cc..eaef7b08e 100644 --- a/server/core/src/https/mod.rs +++ b/server/core/src/https/mod.rs @@ -417,7 +417,10 @@ pub(crate) async fn handle_conn( connection_addr: SocketAddr, enable_haproxy_hdr: bool, ) -> Result<(), std::io::Error> { - let (stream, client_addr) = if enable_haproxy_hdr { + // IMPORTANT: We only check the proxy header on non-loopback requests. This is because + // the healthcheck can't have the proxy header added. Generally it also makes it a bit + // nicer as well for localhost-administration of the instance. + let (stream, client_addr) = if enable_haproxy_hdr && !connection_addr.ip().is_loopback() { match ProxyHdrV2::parse_from_read(stream).await { Ok((stream, hdr)) => { let remote_socket_addr = match hdr.to_remote_addr() { @@ -436,7 +439,7 @@ pub(crate) async fn handle_conn( (stream, remote_socket_addr) } Err(err) => { - error!(?err, "Unable to process proxy v2 header"); + error!(?connection_addr, ?err, "Unable to process proxy v2 header"); return Err(std::io::Error::from(ErrorKind::ConnectionAborted)); } } diff --git a/server/core/src/ldaps.rs b/server/core/src/ldaps.rs index 22ca7fce5..d4fc1f2a1 100644 --- a/server/core/src/ldaps.rs +++ b/server/core/src/ldaps.rs @@ -122,7 +122,10 @@ async fn client_tls_accept( qe_r_ref: &'static QueryServerReadV1, enable_haproxy_hdr: bool, ) { - let (stream, client_addr) = if enable_haproxy_hdr { + // IMPORTANT: We only check the proxy header on non-loopback requests. This is because + // the healthcheck can't have the proxy header added. Generally it also makes it a bit + // nicer as well for localhost-administration of the instance. + let (stream, client_addr) = if enable_haproxy_hdr && !connection_addr.ip().is_loopback() { match ProxyHdrV2::parse_from_read(stream).await { Ok((stream, hdr)) => { let remote_socket_addr = match hdr.to_remote_addr() { @@ -141,7 +144,7 @@ async fn client_tls_accept( (stream, remote_socket_addr) } Err(err) => { - error!(?err, "Unable to process proxy v2 header"); + error!(?connection_addr, ?err, "Unable to process proxy v2 header"); return; } }