# X-Forwarded-For Header — Syntax, Values & Examples

> The chain of client IP addresses a request passed through on its way via proxies and load balancers.

Behind a proxy, the connection your app sees comes from the proxy, not the user. Each proxy appends the address it received the request from, so the header reads `client, proxy1, proxy2`. The catch: clients can send a fake X-Forwarded-For, so only the entries added by proxies you control can be trusted.

- Type: Request header
- Category: Routing & context
- Defined in: [RFC 7239 — Forwarded HTTP Extension](https://www.rfc-editor.org/rfc/rfc7239.html)

## Syntax

```http
X-Forwarded-For: <client>, <proxy1>, <proxy2>
```

## Examples

```http
X-Forwarded-For: 203.0.113.195
```

one proxy in front of the app

```http
X-Forwarded-For: 203.0.113.195, 198.51.100.17
```

the client went through two proxies

## Good to know

- Read from the right: count back past the proxies you run. The leftmost entry is whatever the client claimed.
- In Express, set `app.set("trust proxy", 1)` (the number of proxy hops) so `req.ip` uses this header correctly.
- The standard replacement is `Forwarded: for=203.0.113.195;proto=https`, but X-Forwarded-For remains far more common.
- Related de-facto headers: `X-Forwarded-Proto` (original scheme) and `X-Forwarded-Host` (original Host).

## Who sets X-Forwarded-For

Proxies, load balancers and CDNs add X-Forwarded-For; your app only reads it. In nginx: `proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;`. Vercel and Cloudflare set it for you, and Vercel also sends the client IP in `x-real-ip`.

## Check it

In the browser, open DevTools → Network, pick a request and look under Request Headers. From the command line, curl's verbose mode prints every header it sends, prefixed with `>`:

```sh
curl -sv https://example.com/ -o /dev/null 2>&1 | grep '^>'
```

## FAQ

### Can I use X-Forwarded-For for rate limiting?

Only the entries added by your own proxies. If you trust the leftmost value, anyone can bypass the limit by sending a different fake IP each time.

## Related headers

- [Host](https://www.devkult.com/headers/host.md): The domain name (and port) the request is for, so one server can host many sites.
- [User-Agent](https://www.devkult.com/headers/user-agent.md): Identifies the client software making the request — browser, bot, library or command-line tool.
- [Referer](https://www.devkult.com/headers/referer.md): The address of the page that linked to or loaded the requested resource.

## Further reading

- [Fixing ERR_TOO_MANY_REDIRECTS](https://www.devkult.com/blog/err-too-many-redirects.md)

Open the interactive page: https://www.devkult.com/headers/x-forwarded-for