# Reverse Proxy: IP and SSL

**URL:** <https://forum.xojo.com/t/reverse-proxy-ip-and-ssl/19096>\
**Category:** Web\
**Created:** [September 5, 2014, 12:56pm UTC](https://forum.xojo.com/t/reverse-proxy-ip-and-ssl/19096 "2014-09-05T12:56:10Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![olivierV](https://forum.xojo.com/letter_avatar_proxy/v4/letter/o/919ad9/32.png) [@olivierV](https://forum.xojo.com/u/olivierV)\
**Post date:** [September 5, 2014, 12:56pm UTC](https://forum.xojo.com/t/reverse-proxy-ip-and-ssl/19096/1 "2014-09-05T12:56:10Z")

</div>

Hi all,

Several of us recommend the reverse proxy for WE, including Travis (Xojo inc). It’s very simple, very effective, without limitation. it works perfectly with almost all modern web servers, even on Windows.

But in some cases (SSL with third-party libraries: Google maps …), it is necessary that Xojo handle a “X-Forwarded-Proto: https” header, so that communication works perfectly. And this is not the case: the browser displays alerts, the page does not appear, etc.

Details are in this case: ([https://xojo.com/issue/34272](https://xojo.com/issue/34272))\>] \<[https://xojo.com/issue/34272](https://xojo.com/issue/34272)\>

I just realized that the IP address (session.remoteAddress) must also be false (I have not tested) because the reverse proxy provides its own IP and protocol to Xojo app. This is why web servers (Apache, Microsoft IIS, nginx, lighttpd, abyss webserver …) and load balancers (Elastic Load Balancing, GeekISP, Rackspace …) provide two headers to Xojo app:

- X-Forwarded-Proto (value: http or https)
- X-Forwarded-For (value: IP of real client)

Please, implement these headers.

---

<div class="post-metadata">

**Author:** ![olivierV](https://forum.xojo.com/letter_avatar_proxy/v4/letter/o/919ad9/32.png) [@olivierV](https://forum.xojo.com/u/olivierV)\
**Post date:** [September 9, 2014, 7:35am UTC](https://forum.xojo.com/t/reverse-proxy-ip-and-ssl/19096/2 "2014-09-09T07:35:27Z")

</div>

I just tested for IP: indeed, the Xojo web app can not retrieve the client IP.

Whatever the client, the IP (session.remoteAddress) is always proxy IP,  
ie 127.0.0.1 ☹

Please Vote ([Xojo: Account Login](https://xojo.com/issue/34272))\>]\<[https://xojo.com/issue/34272](https://xojo.com/issue/34272)\>

---

<div class="post-metadata">

**Author:** ![John\_Joyce](https://forum.xojo.com/user_avatar/forum.xojo.com/john_joyce/32/15449_2.png) [@John\_Joyce](https://forum.xojo.com/u/John_Joyce)\
**Post date:** [September 9, 2014, 10:12am UTC](https://forum.xojo.com/t/reverse-proxy-ip-and-ssl/19096/3 "2014-09-09T10:12:45Z")

</div>

Olivier - this is a good request, I will give it a vote.

Also, you can use something like this to get the IP if you know the name of the header your proxy adds. Below is what I use with Haproxy + standalone and it works great.

```auto
IPaddress = WebSession.Header("X-Forwarded-For")
```

---

<div class="post-metadata">

**Author:** ![Tobias\_Bussmann](https://forum.xojo.com/user_avatar/forum.xojo.com/tobias_bussmann/32/297_2.png) [@Tobias\_Bussmann](https://forum.xojo.com/u/Tobias_Bussmann)\
**Post date:** [September 9, 2014, 10:46am UTC](https://forum.xojo.com/t/reverse-proxy-ip-and-ssl/19096/4 "2014-09-09T10:46:41Z")

</div>

workarounds from our toolbox:

[code]Function RemoteAddressFinal(Extends sess as WebSession) As String  
//X-Forwarded-For seems to be a coma seperated list of addresses adding one remote address on each proxy pass. the first should be the client but that may be a private ip  
//X-Real-IP seems to be less commonly used but contain only the remote address of the last proxy pass

Dim result as String  
result = sess.Header(“X-Real-IP”)  
if result \<\> “” then return result  
result = sess.Header(“X-Forwarded-For”).NthField(", ", 1)  
if result \<\> “” then return result  
return sess.RemoteAddress

End Function  
[/code]

and

[code]Function SecureFinal(Extends sess as WebSession) As Boolean  
//somehow there is also a Session.Header(“HTTPS”)=“on” (see Xojo Doc on WebSession.Header), don’t know how this should be treated

if sess.Header(“X-Forwarded-Proto”) = “” then  
return sess.Secure  
else  
if sess.Header(“X-Forwarded-Proto”) = “https” then  
return true  
else  
return false  
end if  
end if

End Function  
[/code]

---

<div class="post-metadata">

**Author:** ![olivierV](https://forum.xojo.com/letter_avatar_proxy/v4/letter/o/919ad9/32.png) [@olivierV](https://forum.xojo.com/u/olivierV)\
**Post date:** [September 9, 2014, 11:51am UTC](https://forum.xojo.com/t/reverse-proxy-ip-and-ssl/19096/5 "2014-09-09T11:51:43Z")

</div>

Thank you very much John and Tobias! it works well for the IP. I have not yet tried for the https.

---

<div class="post-metadata">

**Author:** ![system](https://forum.xojo.com/uploads/default/original/1X/455b4dcc0e61630e9f81940004ddffa49c432a46.png) [@system](https://forum.xojo.com/u/system)\
**Post date:** [October 29, 2020, 5:24pm UTC](https://forum.xojo.com/t/reverse-proxy-ip-and-ssl/19096/6 "2020-10-29T17:24:23Z")

</div>