X-Forwarded-For: reading client IPs and trust boundaries

X-Forwarded-For is a widely used non-standard header through which HTTP proxies and load balancers pass candidate original source IPs downstream.

What can it tell you?

It can be a comma-separated IP chain, usually extended by intermediaries. Which positions are trustworthy depends on the proxy topology and overwrite rules.

How NetKarte shows it

Read X-Forwarded-For under Forwarding headers in the HTTP information card. No input is needed: the received value appears automatically. If several IPs appear, read the comma-separated entries without assuming the first is the selected IP. Its displayed-IP logic trusts forwarding information only from the managed reverse proxy.

Common misconceptions

The first value is not always the user's true IP. Internet-provided values are spoofable, so access control and audits require a clearly defined trusted-proxy range and parsing order.

A list of IPs is not automatically trustworthy

An illustrative value, 192.0.2.20, 198.51.100.8, resembles a client followed by an intermediary appended to the list. But if a proxy preserves an attacker-supplied first entry, that entry is forgeable. Leftmost does not mean authentic.

NetKarte relies on managed intermediaries to sanitize values and uses valid candidates when forwarding information is trusted. A usable Forwarded value has priority. This is not automatic discovery of trusted segments in an arbitrary proxy chain.

If the IP is unexpected

First inspect Source in the top IP card of Network diagnostics to see whether this header was selected. Compare address family and network operator in the same diagnosis. Ask the administrator to inspect intermediary configuration when necessary.

Several entries do not prove VPN use or abuse. Access-control decisions require separate verification of the receiving path and overwrite rules.