concept

X-Forwarded-For

also called Forwarded Header

The header chain recording original client addresses through a series of proxies — and a value that must never be trusted without knowing the topology.

Once traffic passes a proxy, the connection the application sees originates from the proxy. The real client address survives only in a header, which each proxy appends to.

The security problem is that a client can send the header itself. An application taking the first value, or trusting the whole chain, can be told any address it likes — which defeats IP-based rate limiting, IP allow-listing, geo-blocking and fraud signals.

The correct handling is to count from the right: trust only the entries added by proxies you control, which means knowing exactly how many hops sit in front. Most frameworks expose a "trusted proxy count" or "trusted proxy ranges" setting, and it must be configured deliberately rather than defaulted.

The standardised replacement is the Forwarded header, though X-Forwarded-For remains far more common.