Forwarded Header Trust Boundaries

Forwarded carries client-facing protocol, host, and address information across configured intermediaries.

Trust Forwarded only when a known proxy has stripped and rebuilt the field. Normalize and authenticate the proxy chain before using it for redirects, access control, auditing, or URL generation.

httpproxyintermediariesheadersecurity

Reference (http)

Forwarded: for=203.0.113.7;proto=https;host=example.com

Trust Forwarded only when a known proxy has stripped and rebuilt the field. Normalize and authenticate the proxy chain before using it for redirects, access control, auditing, or URL generation.

Common mistakes

Treating client-supplied Forwarded or X-Forwarded-For as proof of source IP, scheme, or host.

Proxies, Gateways, and Forwarded Headers Server-Side Request Forgery (SSRF) Defense Authorization Header

Sources

MDN HTTP Reference
OWASP HTTP Headers Cheat Sheet
IANA HTTP Field Name Registry
RFC 7239: Forwarded HTTP Extension
OWASP Secure Headers Project