X-Forwarded-For
Definition
X-Forwarded-For transmits the original client IP and additional stations of a proxy chain.
A de-facto HTTP header in which proxies can forward the original client IP and proxy chain.
Simply explained
A forwarded web request carries a label with the addresses of its previous stations. Whether this information is trustworthy must be verified.
Why it matters in practice
The term contributes to secure, maintainable, and high-performance web applications as well as resilient technical decisions.
Example from business
A service trusts XFF only from known load balancers and logs the cleaned chain.
Limits and pitfalls
- Clients can forge the header; without a trusted proxy boundary it is unsuitable for authorization.
Origin & history
X-Forwarded-For spread with reverse proxies; the standardized Forwarded header followed as RFC 7239.
Use in mid-sized companies
- Possible example: A service trusts XFF only from known load balancers and logs the cleaned chain.
Frequently asked questions
What does X-Forwarded-For mean?
A de-facto HTTP header in which proxies can forward the original client IP and proxy chain. What should be considered? Clients can forge the header; without a trusted proxy boundary it is unsuitable for authorization.
Sources
- Forwarded HTTP Extension · IETF RFC 7239, Forwarded HTTP Extension
Source checked on 10.10.2026. Editorial usage examples are hypothetical; no evidence of real customer results.
Editorially reviewed on: