Recommended Free Tools
A web application usually sees the IP address of the machine that connected directly to it—not necessarily the person or device that initiated the request. When a reverse proxy, load balancer, or CDN sits in front of the app, the connection’s peer address identifies that intermediary. To use a forwarded client address safely, verify that the request came through a trusted proxy path, then evaluate the forwarded chain from the trusted side.
What a proxy IP tells your application
The application’s socket peer address is the address of the immediate network connection. If a proxy forwards a request to the application, that peer is the proxy. The original client address may be carried separately in an HTTP header such as X-Forwarded-For or the standardized Forwarded header.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
WatchGuard Firebox M295 High Availability Unit with 3 Year Standard Support - HA Device for... | $2,185.11 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
Those headers are claims passed along with the request, not proof of who sent it. A client may supply forged values, and proxies can add, change, or remove forwarding headers. The application must establish which proxy connections it trusts before using a header value for a security decision.
How to evaluate X-Forwarded-For safely
X-Forwarded-For commonly contains a comma-separated sequence: the originating address is conventionally on the left, followed by proxies, with the most recent proxy on the right. That convention alone does not establish that any value is genuine. Selecting the leftmost value without validating the route can let a client influence the address your application records or acts on.
#1 Best Overall
- High Availability (HA) redundant unit for resilient failover and uptime. Operates only as the secondary in an HA pair and must be paired with a primary WatchGuard Firebox of the same model for synchronization and failover. Not a standalone appliance.
- WatchGuard Firebox M295 High Availability Unit with 3 Year Standard Support License (WGM29501603) - The Firebox M295 combines enterprise-grade security with multi-gig connectivity, SD-WAN, TLS decryption, and proxy-based inspection in a compact rackmount design.
- Standard Support covers software updates and round-the-clock emergency help. Add a Basic or Total Security Suite to activate IPS, gateway antivirus, and web filtering so threats are blocked before they reach users.
- Standard Support provides reliable technical assistance and software updates for WatchGuard Firebox appliances. Offering 24x7 help for emergencies and business-hours support for routine needs, it ensures your network stays secure and operational.
- Interfaces and continuity: 4x 2.5Gb RJ45, 4x 1Gb RJ45, 2x 10Gb SFP+ with VLANs and link aggregation, plus RIP, OSPF, BGP, and high availability to keep sites online.
- Anchor the decision to the connection peer. First identify the actual peer address connecting to the application. Do not treat a forwarded header as trustworthy merely because it is present.
- Confirm the ingress path. Identify every reverse proxy, load balancer, or CDN between the public client and the application. Where the design allows, prevent direct access to the origin so requests cannot bypass the trusted ingress.
- Configure which proxies are trusted. Use explicit proxy IP addresses or CIDR networks, or a proxy count only when the request path always has the same controlled number of hops. Do not trust headers from every peer.
- Walk the chain from right to left. Combine all
X-Forwarded-Forheader fields, parse valid addresses, and work back from the application-facing side while the addresses belong to configured trusted proxies. The first address outside that trusted set is the address suitable for security use. It may be an untrusted intermediary proxy rather than the end user. - Apply the result only within its trust conditions. Use the resolved address for enforcement only when the peer and chain have passed the configured checks. If the value is merely useful as a diagnostic hint, label it as unverified.
MDN warns that if a server can be connected to directly from the internet, even while it also sits behind a trusted reverse proxy, no part of the X-Forwarded-For list can be considered trustworthy or safe for security-related use. The origin’s network exposure is therefore part of header validation, not a separate deployment detail.
Choose a trusted-proxy list or count
Both approaches can identify which rightmost forwarded addresses belong to your own proxy path. Neither makes a header safe if untrusted clients can bypass that path or if the application accepts forwarded headers from arbitrary peers.
| Approach | Best fit | What to maintain | Main risk |
|---|---|---|---|
| Trusted proxy IPs or networks | Proxy membership and routes are managed by known addresses or networks. | Keep the configured addresses or CIDR ranges current as infrastructure changes. | Stale or overly broad entries can cause the application to trust an unintended peer. |
| Trusted proxy count | Every request follows a fixed, controlled number of proxy hops. | Keep the configured count aligned with the actual path to the application. | Variable routes or an incorrect count can cause the wrong address to be selected. |
Frameworks implement forwarded-header processing differently. Configure the framework’s own trusted-proxy settings as well as the network boundary. For example, ASP.NET Core documents KnownProxies and KnownNetworks, while Keycloak documents trusted proxy addresses and warns that spoofed proxy headers can affect access control and audit logs. Follow documentation for the deployed framework version rather than copying a setting intended for a different stack.
How Forwarded and provider-specific headers differ
The standardized Forwarded header
Forwarded is the standardized HTTP extension defined by RFC 7239. It can carry a for address, but it is optional and proxy behavior varies; a proxy may add, modify, or remove it. Standardization describes the header format, not whether its values are trustworthy. Apply the same peer and trusted-proxy checks used for other forwarded information.
Cloudflare visitor-IP headers
For requests reaching an origin through Cloudflare, Cloudflare recommends CF-Connecting-IP or True-Client-IP for restoring a visitor IP instead of relying on X-Forwarded-For. These are provider-specific headers, not universal replacements. Use them only when the origin can verify that the request arrived through the trusted Cloudflare path; a directly reachable origin must not accept the header as proof by itself.
Where a resolved address is—and is not—appropriate
Do not base rate limits, IP allowlists, authorization, fraud controls, or audit attribution on an untrusted forwarded value. If proxy validation is misconfigured, an attacker may be able to influence the address your application uses in those decisions. Treat an unverified header value as diagnostic data at most, and label it accordingly.
A successfully resolved network address is still only an address associated with the request path. It does not, by itself, identify a person or establish that a request is authorized. Use it only for the operational purpose your application needs.
Protect client IP data
Client IP addresses are privacy-sensitive. Limit collection and access to what your operational purpose requires, and set retention accordingly. This applies whether the address comes from the socket peer or is resolved from a trusted forwarding chain.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
