I'm using a firefox plugin https://addons.mozilla.org/en-US/firefox/addon/x-forwarded-for-header/ to spoof the X-Forwarded-For Header to
For the following php page:
echo $_SERVER['REMOTE_ADDR'] . '<br />'; echo $_SERVER['HTTP_X_FORWARDED_FOR'] . '<br/>' . '<br />';
When accessing the instance from the instance ip address this is the following output:
When accessing the instance from the load balancer address that the instance is in, this is the following output:
10.173.25.72 126.96.36.199, 188.8.131.52
The first value is local ip of my elastic load balancer.
Since the format of the X-Forwarded-For header is like so http://en.wikipedia.org/wiki/X-Forwarded-For
X-Forwarded-For: client, proxy1, proxy2
Is it safe to assume that the last proxy cannot be spoofed?