Enable_ip_whitelisting and X-Forwarded-For

[Martin]

@ewah

I’m just alerting the fact that there is a chance of injecting that straight in tyk is right on the front lines (or azure loadbalancing, dns round robining, etc.). Maybe there should be a feature to have two whitelists – end clients that can connect to the api (the way it is happening now with allowed_ips) and devices that can connect to the api (allowed_remote_addr, i.e. the LBs, nginxes, localhost, etc.). Or if an untainted remoteAddr were available in request in middleware/virtual endpoint I would be able to make my own decisions via code for this particular use case.

This is a good idea, and on the roadmap is actually to have mutual TLS which would secure the connection between appliances instead of clients.