X-Forwarded-For
Original client IP when request passes through proxies/load balancers. Comma-separated list.
RequestSyntax
X-Forwarded-For: <client>, <proxy1>, <proxy2>Example values
| Value | Explanation |
|---|---|
| 203.0.113.195 | Direct client |
| 203.0.113.195, 70.41.3.18 | Client and proxy |
cURL usage
curl -H "X-Forwarded-For: 1.2.3.4" https://api.example.com
Common mistakes
Trusting without validation (spoofable); use rightmost for last proxy.