Miscellaneous · Request header
X-Forwarded-For
The original client IP when behind a proxy or load balancer.
What is X-Forwarded-For?
A de-facto standard added by reverse proxies to preserve the real client IP. The value is a comma-separated list; the first entry is the original client, followed by each proxy in order.
Typical usage
Read on the origin to identify the real user IP for logging, rate limiting, and geo-IP.
Examples
X-Forwarded-For: 203.0.113.10, 10.0.0.1Common gotchas
Trivially spoofable if your load balancer accepts an existing X-Forwarded-For. Configure the LB to always overwrite (or strip and re-append) this header.
Specification
RFC 7239 (Forwarded is the standard replacement)
Frequently asked questions
What is the X-Forwarded-For HTTP header?
A de-facto standard added by reverse proxies to preserve the real client IP. The value is a comma-separated list; the first entry is the original client, followed by each proxy in order.
Is X-Forwarded-For a request or response header?
X-Forwarded-For is a request header — the client sends it to the server. Read on the origin to identify the real user IP for logging, rate limiting, and geo-IP.
What does a X-Forwarded-For header look like?
A typical X-Forwarded-For header looks like: X-Forwarded-For: 203.0.113.10, 10.0.0.1.
What are common mistakes with X-Forwarded-For?
Trivially spoofable if your load balancer accepts an existing X-Forwarded-For. Configure the LB to always overwrite (or strip and re-append) this header.