X-Forwarded-For – HTTP – MDN Web Docs
The X-Forwarded-For (XFF) header is a de-facto standard
header for identifying the originating IP address of a client connecting to a web server
through an HTTP proxy or a load balancer. When traffic is intercepted between clients
and servers, server access logs contain the IP address of the proxy or load balancer
only. To see the original IP address of the client, the X-Forwarded-For
request header is used.
This header is used for debugging, statistics, and generating location-dependent
content and by design it exposes privacy sensitive information, such as the IP address
of the client. Therefore the user’s privacy must be kept in mind when deploying this
header.
A standardized version of this header is the HTTP Forwarded header.
X-Forwarded-For is also an email-header indicating that an email-message
was forwarded from another account.
Header type
Request header
Forbidden header name
no
SyntaxX-Forwarded-For:
The client IP address
proxy is listed. This means, the right-most IP address is the IP address of the most
recent proxy and the left-most IP address is the IP address of the originating client.
ExamplesX-Forwarded-For: 2001:db8:85a3:8d3:1319:8a2e:370:7348
X-Forwarded-For: 203. 0. 113. 195
X-Forwarded-For: 203. 195, 70. 41. 3. 18, 150. 172. 238. 178
Other non-standard forms:
# Used for some Google services
X-ProxyUser-Ip: 203. 19
Specifications
Not part of any current specification. The standardized version of this header is
Forwarded.
Browser compatibilityBCD tables only load in the browserSee also
Forwarded
X-Forwarded-Host
X-Forwarded-Proto
Via
X-Forwarded-For – HTTP – MDN Web Docs
The X-Forwarded-For (XFF) header is a de-facto standard
header for identifying the originating IP address of a client connecting to a web server
through an HTTP proxy or a load balancer. When traffic is intercepted between clients
and servers, server access logs contain the IP address of the proxy or load balancer
only. To see the original IP address of the client, the X-Forwarded-For
request header is used.
This header is used for debugging, statistics, and generating location-dependent
content and by design it exposes privacy sensitive information, such as the IP address
of the client. Therefore the user’s privacy must be kept in mind when deploying this
header.
A standardized version of this header is the HTTP Forwarded header.
X-Forwarded-For is also an email-header indicating that an email-message
was forwarded from another account.
Header type
Request header
Forbidden header name
no
SyntaxX-Forwarded-For:
The client IP address
proxy is listed. This means, the right-most IP address is the IP address of the most
recent proxy and the left-most IP address is the IP address of the originating client.
ExamplesX-Forwarded-For: 2001:db8:85a3:8d3:1319:8a2e:370:7348
X-Forwarded-For: 203. 0. 113. 195
X-Forwarded-For: 203. 195, 70. 41. 3. 18, 150. 172. 238. 178
Other non-standard forms:
# Used for some Google services
X-ProxyUser-Ip: 203. 19
Specifications
Not part of any current specification. The standardized version of this header is
Forwarded.
Browser compatibilityBCD tables only load in the browserSee also
Forwarded
X-Forwarded-Host
X-Forwarded-Proto
Via
X-Forwarded-For Header Insertion – Avi Networks
By default, Avi Service Engines (SEs) source-NAT (SNAT) traffic destined to servers. Due to SNAT, logs on the application servers will show the layer 4 IP address of the SE rather than the original client’s IP address.
Most application servers can leverage the XFF header as the source IP address for logging or blacklisting.
For HTTP traffic, Avi Vantage can be configured to insert an X-Forwarded-For (XFF) header in client-server requests, to include the original client IP addresses in the requests for logging.
Note: Starting with release 18. 1. 2, this feature is supported for IPv6 in Avi Vantage.
To include the client’s original IP address in HTTP traffic logs, enable Avi Vantage to insert an XFF header into the client traffic destined for the server.
XFF insertion can be enabled in the HTTP application profile that is attached to the virtual service. To do this, follow the steps below.
Navigate to Template > HTTP Application Profile.
In the General tab, select the X-Forwarded-For check box. Note: Optionally, the header can be renamed using the XFF Alternate Name field.
Click on Save.
The Edit Application Profile window appears as shown below.
The profile change affects any virtual services that use the same HTTP application profile.
When XFF header insertion is enabled, the SE checks the headers of client-server packets for existing XFF headers. If XFF headers already exist, the SE first removes any pre-existing XFFs, then inserts its own XFF header. This is done to prevent clients from spoofing their IP address.
There are times when this behavior (removing pre-existing XFF headers) is not desired, such as when multiple proxies may be SNATing and inserting XFF headers. In this case, to insert an XFF header without removing pre-existing XFF headers, use either a DataScript or an HTTP Request Policy.
For example,
(“XFF”, ())
To insert an XFF header without removing the existing XFF headers, you can take the XFF value from the client and concatenate it with the Avi virtual server IP before sending it to the server.
xff = (“X-Forwarded-For”)
if xff then
(“X-Forwarded-For”, xff.. “, “.. ())
end
In this example, () is used because this will fetch the virtual server IP. You can use static values by enclosing them between double quotes (“ “).
Frequently Asked Questions about x-forwarded-for header
What is X-Forwarded-For header used for?
To see the original IP address of the client, the X-Forwarded-For request header is used. This header is used for debugging, statistics, and generating location-dependent content and by design it exposes privacy sensitive information, such as the IP address of the client.Aug 13, 2021
How do you pass X-Forwarded-For header?
X-Forwarded-For Header InsertionNavigate to Template > HTTP Application Profile.In the General tab, select the X-Forwarded-For check box. Note: Optionally, the header can be renamed using the XFF Alternate Name field.Click on Save.
How do I enable X-Forwarded-For HTTP headers?
Log in to the Configuration utility.Go to Local Traffic > iRules.Select Create.Enter a name for the iRule.For Definition, enter the following iRule: when HTTP_REQUEST { HTTP::header insert X-Forwarded-For [IP::remote_addr] } … Select Finished. You must now associate the new iRule with the virtual server.Jul 12, 2019