By enabling X-Foward-For on our proxy, we would essentially be advertising our internal IP addresses externally. However, we use a private range. Everything goes through NAT. So, the best anyone would see is something similar to, 192.168.x.x.

We came up with a scenario where an attacker could use the information in a phishing attack. If they could lure a user into clicking a link, then they would know the user's IP address and may be more able to impersonate someone from IT in a phishing call.

I'm interested in learning other scenarios where having X-Foward-For enabled on the proxy could have a negative effect. We would NOT be using this for authentication in any scenario. How could this information be used in an attack?



1 Answer 1


With enough traffic from your internal users, an attacker could map the internal networks of an organization. There might be very low value in this data, however, if DHCP expires IPs quickly, or if the internal network is predictable (or uninteresting) on its own. It would also require a lot of traffic from the network's users to be helpful.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .