topic
Verified 2026-09-18Proxies, Gateways, and Forwarded Headers
Intermediaries can forward requests, terminate connections, cache content, or translate protocols.
Use Forwarded or a trusted X-Forwarded-* convention to preserve client-facing context. Only trust values inserted by a known proxy, and strip untrusted incoming values.
httpproxysecurityrouting
Reference (http)
Forwarded: for=203.0.113.7;proto=https;host=example.com Via: 1.1 proxy.example.net
Use Forwarded or a trusted X-Forwarded-* convention to preserve client-facing context. Only trust values inserted by a known proxy, and strip untrusted incoming values.
Common mistakes
- Treating client-supplied Forwarded or X-Forwarded-For values as proof of the source IP or protocol.