What is the X-Forwarded-For header?

The X-Forwarded-For (XFF) header is a de-facto standard header for identifying the originating IP address of a client connecting to a web server through an HTTP proxy or a load balancer. When traffic is intercepted between clients and servers, server access logs contain the IP address of the proxy or load balancer only. To see the original IP address of the client, the X-Forwarded-For request header is used.

This header is used for debugging, statistics, and generating location-dependent content and by design it exposes privacy sensitive information, such as the IP address of the client. Therefore the user's privacy must be kept in mind when deploying this header.

A standardized version of this header is the HTTP Forwarded header. The Forwarded header contains information from the client-facing side of proxy servers that is altered or lost when a proxy is involved in the path of the request.

X-Forwarded-For is also an email-header indicating that an email-message was forwarded from another account.

Header type      Request header
Forbidden header name      no

Syntax

X-Forwarded-For: <client>, <proxy1>, <proxy2>

Directives

<client>
The client IP address
<proxy1>, <proxy2>
If a request goes through multiple proxies, the IP addresses of each successive proxy is listed. This means, the right-most IP address is the IP address of the most recent proxy and the left-most IP address is the IP address of the originating client.

Examples

X-Forwarded-For: 2001:db8:85a3:8d3:1319:8a2e:370:7348

X-Forwarded-For: 203.0.113.195

X-Forwarded-For: 203.0.113.195, 70.41.3.18, 150.172.238.178

Other non-standard forms:

# Used for some Google services
X-ProxyUser-Ip: 203.0.113.19
  • IP Address, IPv4, IPv6, connections
  • 0 Users Found This Useful
Was this answer helpful?

Related Articles

Can I get username & password authentication instead of IP authentication?

Yes, you can use either a username and password or IP authentication or both with our proxies.

Can I switch my proxies?

Yes, you can switch your proxies out instantly by clicking the Renew Proxies button that will...

Can I test a proxy before purchasing?

We cannot provide free proxies for testing due to possible abuse. You can begin by purchasing 5...

Can I use your proxies for emailing?

We allow all types of web mailing such as GMail, Yahoo, and AOL, but you cannot use our proxies...

Can I use your proxies for Facebook, Twitter, YouTube, or other social networking websites?

We do not block access to any website, but due to the dynamic nature and security of social...