What is the Forwarded header?

Forwarded is a standardized HTTP header for proxies to pass original connection information downstream. It can contain for, by, host, and proto parameters.

What can it tell you?

Depending on configuration, it can show a candidate client IP, protocol, or original host. Multiple elements may appear after multiple intermediaries.

How NetKarte shows it

Read Forwarded under Forwarding headers in the HTTP information card. No input is needed. To see whether it was selected for the IP, compare Source and the IP address in the top IP card of Network diagnostics. IP selection trusts only the managed reverse-proxy boundary, not the mere presence of a value.

Common misconceptions

Clients can send Forwarded themselves, so authenticity requires a trusted proxy to overwrite or validate it. Its absence also does not prove that no proxy was used.

Read separators and parameters

This is an illustrative example:

for=192.0.2.20;proto=https;host=example.com, for=198.51.100.8

Semicolons separate parameters within an element; commas separate elements. for describes the connecting side at that stage, by the intermediary, proto the original scheme, and host the original destination. IPv6 may require quotes and brackets, so simply splitting on colons is unsafe.

Compare display with selection

Displaying a header and accepting its IP are separate decisions. When forwarding information is trusted, NetKarte checks valid Forwarded IP candidates before the other sources. Its Protocol display separately reads X-Forwarded-Proto; it does not necessarily use Forwarded's proto.

These example addresses reveal no real route. Administrators should verify what each intermediary removes, overwrites, or appends rather than base authentication or access control on a displayed string.