Miscellaneous · Request header
X-Forwarded-For
The original client IP when behind a proxy or load balancer.
What is X-Forwarded-For?
A de-facto standard added by reverse proxies to preserve the real client IP. The value is a comma-separated list; the first entry is the original client, followed by each proxy in order.
Typical usage
Read on the origin to identify the real user IP for logging, rate limiting, and geo-IP.
Examples
X-Forwarded-For: 203.0.113.10, 10.0.0.1Common gotchas
Trivially spoofable if your load balancer accepts an existing X-Forwarded-For. Configure the LB to always overwrite (or strip and re-append) this header.
Specification
RFC 7239 (Forwarded is the standard replacement)