X-Forwarded-For

X-Forwarded-For: 203.0.113.7, 10.0.0.2

What it does

The client IPs a request passed through on its way in. Whatever the outermost client CLAIMS, plus each proxy's addition.

In practice

Anyone can send this header with any value, so the left-most entry is attacker-controlled unless your edge strips and re-adds it. Rate limiting or auth keyed on a naive X-Forwarded-For read is spoofable by construction; trust only the entry appended by a proxy you run, or use the standardised Forwarded header knowingly.

← All headers