The surprising complexity of interpreting X-Forwarded-For safely
I've seen a lot of uncertainty and misunderstandings about how to handle IP addresses correctly when developing and operating a web service:
- What's my user's IP address?
- How do I use the
X-Forwarded-For
header? - What's the difference between that and
X-Real-IP
or other HTTP headers?
This post explains the need for X-Forwarded-For
(hereafter, "XFF"),
provides a mental model for working with it, and then gives guidance
on how to handle different situations.
I'll first cover why it exists, how to think about it, how to use it, and finally some alternative approaches that may be more appropriate.
(See the end for a summary.)