HTTP headers / request header

X-Forwarded-For

X-Forwarded-For: 203.0.113.7, 70.41.3.18

What it does

The de-facto chain of client IPs appended by each proxy hop. The leftmost entry claims to be the original client.

The gotcha

Trivially spoofable by the client — only trust the entries YOUR proxies appended, or use the standardized Forwarded header.

Debugging headers on a phone

The fastest way to see what X-Forwarded-For is actually doing is to send the request and read both sides raw — ReqPad shows auto-generated and custom headers for every request, on all six protocols, with history. Related references: status codes · Authorization · Accept · Accept-Encoding · Accept-Language · If-None-Match · If-Match

Inspect X-Forwarded-For on a live request.

Build the request, send it, read raw headers and timing — from your iPhone. Free to start.

Download on the App Store