How X-Forwarded-For works
Each proxy appends the address it received the request from, so the header reads client, proxy1, proxy2. Anyone can send a fake value, so never take the first entry blindly: count from the right, skipping the proxies you operate, and take the first address you don’t trust. Frameworks have settings for this, such as Express’s trust proxy.
Examples
X-Forwarded-For: 203.0.113.195, 70.41.3.18, 150.172.238.178Common mistakes
-
Cloudflare also sends the client address in
CF-Connecting-IP, and nginx setups often useX-Real-IP; trust them only when requests can reach you through that proxy alone.
Check it
# Show the request headers curl sends (lines starting with >)
curl -sv -o /dev/null https://example.com 2>&1 | grep '^>'Paste a full set of response headers into the HTTP header checker to get every header explained and common mistakes flagged.
Related headers
- X-Forwarded-Proto: tells the application whether the client connected over HTTPS or HTTP, when TLS ends at a proxy.
- Forwarded: the standard form of the X-Forwarded-* headers: client address, protocol and host in one header.
- Host: names the domain (and port) the request is for, so one server can host many sites.
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What does the X-Forwarded-For header do?
The X-Forwarded-For request header carries the original client IP address through proxies and load balancers. Each proxy appends the address it received the request from, so the header reads client, proxy1, proxy2. Anyone can send a fake value, so never take the first entry blindly: count from the right, skipping the proxies you operate, and take the first address you don’t trust. Frameworks have settings for this, such as Express’s trust proxy.
How do I see the X-Forwarded-For header?
Open your browser’s dev tools, select a request in the Network tab and look under Request Headers. On the command line, "curl -v https://example.com" prints the request headers it sends, marked with ">".