The X-Forwarded-For header is used by some HTTP proxies to identify the IP address of the client. The wiki page (linked above) mentions that ISPs may use this header as well.
In addition there are a variety additional headers that may be used to identify a client. Some examples include:
- HTTP_X_FORWARDED_FOR can be comma delimited list of IPs
Can I use any of these headers to for access control, to block or allow access my site?
e.g. Block in an escalating manner: HTTP_Header_X first then, client IP?
What are the known usages of these headers? e.g. ISPs, proxy software like Squid, etc.
I was then considering that some web servers may dynamically alter their response based on the presence (or lack of) these header. Suppose a server banned users by IP address. Should it ban a user based upon the received IP or the one specified in this header? I then considered the possibility of spoofing this header as a way to work around an IP-ban that the server may have imposed.
- What security concerns may exist around these headers, what is the appropriate way to address it?
e.g. include that is relevant for logging, etc.