# What is X-Forwarded-For and when can you trust it?

DevFeed: [What is X-Forwarded-For and when can you trust it?](<https://devfeed.tech/articles/what-is-x-forwarded-for-and-when-can-you-trust-it-19102.md>)

Original publisher: [Read original article](<https://httptoolkit.com/blog/what-is-x-forwarded-for/>)

Author: HTTP Toolkit; Phil Sturgeon

Published: 2024-01-31T17:00:00Z

Content type: tutorial

Language: en

Sources: [HTTP Toolkit](<https://devfeed.tech/sources/http-toolkit.md>)

Topics: [HTTP](<https://devfeed.tech/topics/http.md>), [client](<https://devfeed.tech/topics/client.md>), [servers](<https://devfeed.tech/topics/servers.md>), [backends](<https://devfeed.tech/topics/backends.md>), [Load Balancing](<https://devfeed.tech/topics/load-balancing.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>)

Tags: [apis](<https://devfeed.tech/tags/apis.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [backend](<https://devfeed.tech/tags/backend.md>), [http](<https://devfeed.tech/tags/http.md>), [ipv4](<https://devfeed.tech/tags/ipv4.md>), [ipv6](<https://devfeed.tech/tags/ipv6.md>), [load-balancer](<https://devfeed.tech/tags/load-balancer.md>), [proxy](<https://devfeed.tech/tags/proxy.md>), [request](<https://devfeed.tech/tags/request.md>), [server](<https://devfeed.tech/tags/server.md>), [servers](<https://devfeed.tech/tags/servers.md>), [standards](<https://devfeed.tech/tags/standards.md>)

## AI overview

This article explains how the X-Forwarded-For HTTP header records the source IP addresses of clients across proxies, CDNs, load balancers, and other intermediaries. It also describes common uses such as authentication checks, traffic distribution, data localization, and geographic content delivery.

## Source excerpt

The X-Forwarded-For (XFF) HTTP header provides crucial insight into the origin of web requests. The header works as a mechanism for conveying the original source IP addresses of clients, and not just across one hop, but through chains of multiple intermediaries. This list of IPv4 and IPv6 addresses is helpful to understand where requests have really come from in scenarios where they traverse several servers, proxies, or load balancers. A typical HTTP request goes on a bit of a journey, traversing multiple layers of infrastructure before reaching its destination. Without the X-Forwarded-For header, the receiving server would only see the IP address of the last intermediary in the chain (the direct source of the request) rather than the true client origin. {/* sequenceDiagram actor Client as Client 28.178.124.142 participant CDN as CDN 198.40.10.101 participant LB as Load Balancer 198.40.10.102 participant B as Backend App 10.0.0.1 Client->>CDN: CDN->>LB: LB->>B: */} In thie example, by the time the backend application is seeing an incoming request, the IP address of the original client is long forgotten. This is where the X-Forwarded-For header can help out. It looks like this: X-Forwarded-For: 28.178.124.142, 198.40.10.101 The goal here is to give a proxy the chance to say "Alright hang on, I'm forwarding you a request, and this is the history of where it came from, as far as I know". Note that the last proxy will not add its own IP address to the list, because that's already available: if the receiver of the request cares about who is calling it directly, they can combine the X-Forwarded-For with the request's source IP address from the incoming connection, e.g: req.connection.remoteAddress in NodeJS. In this example above, the load balancer has said "Hey backend app, I am forwarding you a request that came from this client, via the CDN", and it doesn't need to pop its own IP in there because the backend app can already tell if it's coming from the load balancer or