By enabling X-Foward-For on our proxy, we would essentially be advertising our internal IP addresses externally. However, we use a private range. Everything goes through NAT. So, the best anyone would see is something similar to, 192.168.x.x.
We came up with a scenario where an attacker could use the information in a phishing attack. If they could lure a user into clicking a link, then they would know the user's IP address and may be more able to impersonate someone from IT in a phishing call.
I'm interested in learning other scenarios where having X-Foward-For enabled on the proxy could have a negative effect. We would NOT be using this for authentication in any scenario. How could this information be used in an attack?