{"record":{"id":"6fb2cf423beb74b1","repo":"ory/hydra","slug":"neither-remote-address-nor-any-x-forwarded-for-val","errorCode":null,"errorMessage":"neither remote address nor any x-forwarded-for values match CIDR ranges %+v: %v, ranges, check)","messagePattern":"neither remote address nor any x-forwarded-for values match CIDR ranges %\\+v: (.+?), ranges, check\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/tlsx/termination.go","lineNumber":94,"sourceCode":"\tremoteIP, _, err := net.SplitHostPort(r.RemoteAddr)\n\tif err != nil {\n\t\treturn errors.WithStack(err)\n\t}\n\n\tcheck := []string{remoteIP}\n\tfor fwd := range strings.SplitSeq(r.Header.Get(\"X-Forwarded-For\"), \",\") {\n\t\tcheck = append(check, strings.TrimSpace(fwd))\n\t}\n\n\tfor _, ipNet := range networks {\n\t\tfor _, ip := range check {\n\t\t\taddr := net.ParseIP(ip)\n\t\t\tif ipNet.Contains(addr) {\n\t\t\t\treturn nil\n\t\t\t}\n\t\t}\n\t}\n\treturn errors.Errorf(\"neither remote address nor any x-forwarded-for values match CIDR ranges %+v: %v, ranges, check)\", networks, check)\n}\n","sourceCodeStart":76,"sourceCodeEnd":96,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/tlsx/termination.go#L76-L96","documentation":"matchesRange verifies that a plain-HTTP request may be TLS-terminated by checking that either the direct RemoteAddr or any X-Forwarded-For entry falls inside one of the configured allowTerminationFrom CIDR ranges. If none of the candidate IPs (remote IP plus every comma-separated X-Forwarded-For value) is contained in any configured network, it returns this error and the middleware rejects the request with 502 Bad Gateway. It is the library's safeguard against accepting TLS-terminated traffic from untrusted proxies.","triggerScenarios":"A request arrives over plain HTTP, allowTerminationFrom is configured, but the proxy's IP (RemoteAddr) and all X-Forwarded-For entries are outside the configured CIDR ranges — e.g. a new proxy pod IP, an SNAT-ed address, or the X-Forwarded-For header being stripped or appended with unexpected values.","commonSituations":"Kubernetes: proxy/ingress pods rescheduled onto nodes with IPs outside the configured subnet; adding a second load balancer whose egress IP is not whitelisted; configuring 127.0.0.1/32 but connecting through Docker bridge or a container network; X-Forwarded-For missing so only RemoteAddr is checked.","solutions":["Add the actual proxy/source IP range to the allowTerminationFrom configuration (e.g. the Kubernetes node/pod CIDR or LB egress range).","Verify with logs what RemoteAddr and X-Forwarded-For the service sees and confirm the CIDR notation is correct (net.ParseCIDR format, e.g. 10.0.0.0/8).","If the proxy legitimately strips X-Forwarded-For, whitelist the proxy's direct IP instead.","If you do not run a TLS-terminating proxy at all, serve the service over HTTPS directly so the middleware is bypassed (r.TLS != nil)."],"exampleFix":"// before (config)\nallowTerminationFrom:\n  - 127.0.0.1/32\n// after (include proxy subnet)\nallowTerminationFrom:\n  - 127.0.0.1/32\n  - 10.244.0.0/16","handlingStrategy":"validation","validationCode":"// verify source IP is inside allowTerminationFrom before deploying\nip := net.ParseIP(proxyIP)\n_, cidr, _ := net.ParseCIDR(\"10.244.0.0/16\")\nif !cidr.Contains(ip) {\n    log.Printf(\"proxy IP %s not in allowTerminationFrom\", proxyIP)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Whitelist whole subnets (pod/node CIDR), not single IPs, in allowTerminationFrom.","Re-check the config whenever proxy infrastructure changes (new LB, node pool resize).","Log RemoteAddr and X-Forwarded-For on 502 responses to debug range mismatches quickly."],"tags":["network","cidr","proxy","oryx"],"backgroundTag":"cidr-whitelist-mismatch","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}