{"id":296,"date":"2026-10-23T22:55:39","date_gmt":"2026-10-23T14:55:39","guid":{"rendered":"https:\/\/glossary.clawoxy.com\/?p=296"},"modified":"2026-10-23T22:55:39","modified_gmt":"2026-10-23T14:55:39","slug":"x-forwarded-for-xff","status":"publish","type":"post","link":"https:\/\/www.clawoxy.com\/glossary\/x-forwarded-for-xff\/","title":{"rendered":"X-Forwarded-For (XFF)"},"content":{"rendered":"\n

X-Forwarded-For<\/code> (XFF) is an HTTP header commonly used by proxies to pass along the IP address of a client that connected through them. A chain of proxies may append multiple addresses, usually separated by commas.<\/p>\n\n\n\n

Trust the proxy chain, not the header by itself<\/h2>\n\n\n\n

Clients can send arbitrary headers. A server should use XFF for security or logging only when the request came through a trusted proxy that overwrites or validates the value. Otherwise an attacker can supply a misleading address. The trusted proxy configuration determines which entries in a chain are meaningful.<\/p>\n\n\n\n

For crawler diagnostics, XFF may explain how an application identifies the original client behind a load balancer. It should not be assumed to exist or be accurate on a direct request. Avoid adding it yourself unless you operate the trusted proxy that sets it.<\/p>\n\n\n\n

Do not log full IP chains longer than necessary; define retention and access rules for network identifiers.<\/p>\n\n\n\n

Sources<\/h2>\n\n\n\n