X-Forwarded-For

RequestActive

X-Forwarded-For carries the originating client IP address through a chain of proxies and load balancers. Each proxy appends the IP it received the request from. The leftmost IP is the original client – but it can be spoofed. Use the rightmost trusted proxy's addition, or the standardized Forwarded header (RFC 7239) for new systems.

X-Forwarded-For: <client-ip>[, <proxy1-ip>, <proxy2-ip>]*

Description

X-Forwarded-For is a de-facto standard header for passing client IP through reverse proxies. The format is a comma-separated list of IPs appended by each proxy in chain order. Never trust the leftmost value unconditionally – a client can set any value. Only the first IP appended by a trusted proxy (rightmost in the chain before the trust boundary) is reliable.

Directives

Directive	Description
Forwarded	RFC 7239 standardized replacement: Forwarded: for=192.0.2.60;proto=http;by=203.0.113.43

Examples

Single proxy

http

X-Forwarded-For: 203.0.113.195

Proxy chain

http

X-Forwarded-For: 203.0.113.195, 70.41.3.18, 150.172.238.178

RFC 7239 modern

http

Forwarded: for=203.0.113.195;proto=https;host=example.com

Specification

RFC 7239 – X-Forwarded-For specification →