XFF

X-Forwarded-For

A standard HTTP header field used to identify the originating IP address of a client connecting to a web server through an HTTP proxy or load balancer. When a user’s request passes through multiple proxies or servers, each intermediary adds its IP address to the XFF header, creating a comma-separated list of IP addresses.  

The XFF header is added to the HTTP request by the proxy or load balancer that receives the original request from the client. The client does not add it manually.

Here’s how the XFF header would look in an HTTP request, assuming the client’s IP is 192.168.1.100 and it’s passing through a proxy with IP 10.0.0.10:

GET / HTTP/1.1
Host: example.com
X-Forwarded-For: 192.168.1.100

As the request passes through additional proxies or load balancers, each intermediary appends its IP address to the XFF header:

GET / HTTP/1.1
Host: example.com
X-Forwarded-For: 192.168.1.100, 10.0.0.10, 192.0.2.25

The web server receiving this request can then parse the XFF header to determine the original client IP (192.168.1.100) and potentially other details about the request path.

The primary purpose of XFF is to provide the web server with visibility into the client’s original IP address, even when the request has been routed through multiple intermediaries. This information is crucial for various reasons:

• Accurate logging: Web servers typically log the IP addresses of incoming requests for security and analytics purposes. Without XFF, the server logs would only show the IP address of the last proxy in the chain, obscuring the true origin of the request.
• Geolocation: XFF allows web servers to determine the geographic location of the user based on their original IP address, which can be used for content personalization, targeted advertising, or fraud detection.
• Security: By knowing the original IP address, web servers can identify suspicious activity patterns, such as multiple login attempts from different locations, and take appropriate action to protect user accounts.

It’s important to note that XFF is not exclusively used in conjunction with proxies. It can also be used with load balancers and other network intermediaries that modify the IP address of the original request.

However, XFF can be easily spoofed, so web servers should not blindly trust the information contained in this header. To ensure its accuracy, it is crucial to validate the XFF header against other sources of information, such as the client’s IP address as reported by the TCP/IP stack.

• Abbreviation: XFF