I see no huge issue triggering an self-XSS since injecting content into an existing TCP connection is already difficult enough (thanks to initial sequence numbers). And, even if an attacker would be able to inject valid TCP packets, he would be probably more interested into getting your session information directly to his IP, without going through XSS.
Things change a little, when the self-XSS is persistent. i.e. it ends stored in the DB and can be re-run at a later stage. In that case it is pretty much a full XSS, since you can, for example, give access to your account to other users who will run the XSS. But not sanitizing data provided by a user that goes into the DB should be a crime.
Still, on the questions:
While the true solution would be to automatically sanitize ip address before displaying it, i would like to know when should we really do it?
Not only the IP, but every piece of information provided by a user request. And not only in specific cases but always. If you do not sanitize every piece of information and send it back, or leave it in the DB and send it back later, you will have XSS problems.
Is there any configurations where webservers automatically change the
REMOTE_ADDR to the value of one of this headers?
Webservers don't do that (although some nginx hacking allowed me to perform it, but that would be a horrible practice). Webservers pass variables to the CGI program/script. Apache's
mod_cgi pass things through environment variables and STDIN (for POST content). Nginx controls the variables that are present in its configuration to go to the CGI through the
scgi_params file (normally at
How are those headers useful anyway?
See my rant-comment about akamai and
X-Forwarded-For is the correct HTTP header.
X-Forwarded-For is meant for connections that go through some form of proxy (as opposed to going through a NAT).
The only thing I'm seeing is when client pass by some proxy for un-obvious reason but still want the website to know his ip address. Is there any other?
And yes, that is the main and (not considering possible dirty hacks) only use for
X-Forwarded-For. That may seem not very useful but is much more common than you imagine.
Offices/datacentres often have huge proxy/firewalls to which their internal network pass through to the internet. Some of the internal machines have private IPs and depend on a NAT but other do have their own public IPs and depend on the firewall as a proxy (the firewall must be stateful to be in any way effective). This situation requires the use of 'X-Forwarded-For' to know from which part of the network a request comes.
Internet proxies (free and non-free) often use that header to ensure that you can visit websites that are tailored to your location. e.g. connecting directly to
google.com I get redirected to
google.co.uk (since I live in the UK). But if i use a proxy in Poland and do not set
X-Forwarded-For I get redirected to
google.com.pl. If I use the proxy and set
X-Forwarded-For to my home IP (in the UK) I get correctly redirected to