Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using a firefox plugin to spoof the X-Forwarded-For Header to

For the following php page:

echo $_SERVER['REMOTE_ADDR']  . '<br />'; 
echo $_SERVER['HTTP_X_FORWARDED_FOR']  . '<br/>' . '<br />'; 

When accessing the instance from the instance ip address this is the following output:

When accessing the instance from the load balancer address that the instance is in, this is the following output:,

The first value is local ip of my elastic load balancer.

Since the format of the X-Forwarded-For header is like so

X-Forwarded-For: client, proxy1, proxy2

Is it safe to assume that the last proxy cannot be spoofed?

share|improve this question

migrated from Nov 19 '12 at 14:52

This question came from our site for system and network administrators.

Do you mean the "last proxy" as the proxy connecting to the server that's actually serving the request, or the one the client's connecting to? – Shane Madden Nov 19 '12 at 5:48
@ShaneMadden In my load balancer example the proxy would be (proxy1). Is it possible to spoof that? – user784637 Nov 19 '12 at 5:52
up vote 5 down vote accepted

The load balancer sets the 'most recent' part of the header.

As long as you trust the load balancer (and the connection between your server and the load balancer) to set the header as the IP address at the other end of its TCP connection, then you can trust that the last entry in the header is an accurate representation of the source of the connection (from the load balancer's perspective).

share|improve this answer
As long as the user can't make a request to the server directly (bypassing the load balancer) and spoof the X-Forwarded-For header. ;-) – Simon East Jul 9 '14 at 9:21

Value of the X-Forwarded-For header field can be set at the client's side - this can also be termed as X-Forwarded-For spoofing. However, when the web request is made via a proxy server (a non-elite proxy server with low anonymity level), the proxy server modifies the X-Forwarded-For field by appending the IP address of the client (user). This will result in 2 comma separated IP addresses in the X-Forwarded-For field. Hence, the web server, if needed, may detect the use of a proxy server and most likely detect the spoofing. The following article gives an explanation of this with a Python code sample Spoof X-Forwarded-For. Hence, using elite proxies (which has high anonymity level) may help to hide the actual IP address of the client.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.