X-Forwarded-For
also called Forwarded Header
The header chain recording original client addresses through a series of proxies — and a value that must never be trusted without knowing the topology.
Once traffic passes a proxy, the connection the application sees originates from the proxy. The real client address survives only in a header, which each proxy appends to.
The security problem is that a client can send the header itself. An application taking the first value, or trusting the whole chain, can be told any address it likes — which defeats IP-based rate limiting, IP allow-listing, geo-blocking and fraud signals.
The correct handling is to count from the right: trust only the entries added by proxies you control, which means knowing exactly how many hops sit in front. Most frameworks expose a "trusted proxy count" or "trusted proxy ranges" setting, and it must be configured deliberately rather than defaulted.
The standardised replacement is the Forwarded header, though X-Forwarded-For remains far more
common.