X-Forwarded-For (XFF) is an HTTP header commonly used by proxies to pass along the IP address of a client that connected through them. A chain of proxies may append multiple addresses, usually separated by commas.
Trust the proxy chain, not the header by itself
Clients can send arbitrary headers. A server should use XFF for security or logging only when the request came through a trusted proxy that overwrites or validates the value. Otherwise an attacker can supply a misleading address. The trusted proxy configuration determines which entries in a chain are meaningful.
For crawler diagnostics, XFF may explain how an application identifies the original client behind a load balancer. It should not be assumed to exist or be accurate on a direct request. Avoid adding it yourself unless you operate the trusted proxy that sets it.
Do not log full IP chains longer than necessary; define retention and access rules for network identifiers.
Leave a Reply