What are multiple IP addresses in the X-Forwarded-For header?

The X-Forwarded-For (XFF) header is a de-facto standard HTTP header used to identify the originating IP address of a client connecting to a web server through an HTTP proxy or load balancer. When a request passes through multiple proxies or load balancers, each one may add its own IP address to the header, resulting in a list of IP addresses. This list represents the chain of servers that the request traversed.

Typically, the first IP address in the X-Forwarded-For header is the IP address of the original client. Subsequent IP addresses represent proxies or load balancers through which the request was routed. The order is significant, as it indicates the path the request took to reach the destination server. For example, an XFF header might look like this: X-Forwarded-For: 203.0.113.195, 192.0.2.43, 10.0.0.5. In this case, 203.0.113.195 is the client IP, 192.0.2.43 is the first proxy and 10.0.0.5 is the final proxy or load balancer before the web server.

It's crucial to note that while the X-Forwarded-For header is very common, it can be modified or spoofed. So, while it's a valuable tool for obtaining the client's originating IP, it should not be the sole basis of trust in security-sensitive scenarios. Web servers usually extract the client's IP from the first entry in the list but must be aware of the potential for tampering. Furthermore, different web server configurations can handle the X-Forwarded-For header differently, which can result in variations in how the correct client IP is resolved.