Record · corpus.blog/posts/01a0871f-a73c-7007-b15c-900faff7a0c3

The perils of the “real” client IP

Adam Pritchard's blog and miscellany · published 4 March 2022

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at adam-p.ca Wayback capture

3blogs citing

First cited: 4 Mar 2022
Most recent: 29 Apr 2026
Rank this month: not ranked
Links from this post: 107
Words captured: 12,153

Cited by

Blog

In the post

Date

Blog - Andrew Ayer

FastCGI: 30 Years Old and Still the Better Protocol for Reverse Proxies Read at the source ↗

29 Apr 2026

poorlydefinedbehaviour.github.io

Reading list 2023 Read at the source ↗

1 Jan 2024

Blog - Andrew Ayer

How I'm Using SNI Proxying and IPv6 to Share Port 443 Between Webapps Read at the source ↗

15 Apr 2022

brainonfire.net

The surprising complexity of interpreting X-Forwarded-For safely Read at the source ↗

4 Mar 2022

Links from this post

Link

Host

The scary state of IPv6 rate-limiting Read at the source ↗

adam-p.ca

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For

developer.mozilla.org

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Forwarded

developer.mozilla.org

https://chrome.google.com/webstore/detail/x-forwarded-for-header/hkghghbnihliadkabmlcmcgmffllglin

chrome.google.com

https://datatracker.ietf.org/doc/html/rfc2616

datatracker.ietf.org

https://pkg.go.dev/net/http

pkg.go.dev

https://github.com/twisted/twisted/blob/ebb2d360070e468981377b917e3a728ff4e6c7f6/src/twisted/web/http.py

github.com

https://github.com/golang/go/issues/51493

github.com

https://en.wikipedia.org/wiki/Private_network

en.wikipedia.org

https://github.com/go-chi/httprate/blob/463924d478ea0c19de7265b97371a59a7ebf5fdd/httprate.go

github.com

https://en.wikipedia.org/wiki/X-Forwarded-For

en.wikipedia.org

https://github.com/mdn/content/issues/13703

github.com

https://adam-p.ca/misc/MDN-XFF.pdf

adam-p.ca

https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/x-forwarded-headers.html

docs.aws.amazon.com

https://techcommunity.microsoft.com/t5/iis-support-blog/how-to-use-x-forwarded-for-header-to-log-actual-client-ip/ba-p/873115

techcommunity.microsoft.com

https://www.geeksforgeeks.org/http-headers-x-forwarded-for/

geeksforgeeks.org

https://developers.cloudflare.com/fundamentals/get-started/http-request-headers/

developers.cloudflare.com

https://www.keycdn.com/blog/x-forwarded-for-cdn

keycdn.com

https://totaluptime.com/kb/prevent-x-forwarded-for-spoofing-or-manipulation/

totaluptime.com

https://docs.fastly.com/signalsciences/faq/real-client-ip-addresses/

docs.fastly.com

https://datatracker.ietf.org/doc/html/rfc7239

datatracker.ietf.org

https://en.wikipedia.org/wiki/Internet_geolocation

en.wikipedia.org

https://www.joelonsoftware.com/2005/05/11/making-wrong-code-look-wrong/

joelonsoftware.com

https://support.cloudflare.com/hc/en-us/articles/206776727-Understanding-the-True-Client-IP-Header

support.cloudflare.com

https://nginx.org/en/docs/http/ngx_http_realip_module.html

nginx.org

https://httpd.apache.org/docs/trunk/mod/mod_remoteip.html

httpd.apache.org

https://github.com/adam-p/adam-p.github.com/blob/5edea5c18308d6260730fad9e319c737f0d2dfc7/content/blog/2022-02-26-x-forwarded-for.md

github.com

https://github.com/adam-p/adam-p.github.com/issues/11

github.com

https://community.akamai.com/customers/s/article/Difference-Between-Akamai-True-Client-IP-header-and-Default-X-Forwarded-For

community.akamai.com

https://techdocs.akamai.com/property-mgr/docs/origin-server

techdocs.akamai.com

https://community.akamai.com/customers/s/article/What-IP-address-does-True-Client-IP-header-have

community.akamai.com

https://developer.fastly.com/reference/http/http-headers/Fastly-Client-IP/

developer.fastly.com

https://docs.microsoft.com/en-us/azure/frontdoor/front-door-http-headers-protocol

docs.microsoft.com

https://github.com/go-chi/chi/blob/c97bc988430d623a14f50b7019fb40529036a35a/middleware/realip.go

github.com

https://github.com/go-chi/httprate/blob/463924d478ea0c19de7265b97371a59a7ebf5fdd/README.md?plain=1

github.com

https://github.com/go-chi/chi/issues/711

github.com

https://github.com/go-chi/chi/pull/967

github.com

https://github.com/go-chi/chi/releases/tag/v5.3.0

github.com

https://github.com/go-chi/chi/issues/708

github.com

https://github.com/go-chi/httprate

github.com

https://github.com/didip/tollbooth

github.com

https://github.com/didip/tollbooth/blob/d2340101f440011dd593e8b6787f5b1a437c2516/README.md

github.com

https://github.com/didip/tollbooth/blob/e1a6b41b35e95810a7dce638996b15f136424ed2/limiter/limiter.go

github.com

https://github.com/didip/tollbooth/blob/2e5b779d07015e6a4386c6cc1a36612c17d54eb5/tollbooth.go

github.com

https://github.com/didip/tollbooth/blob/2e5b779d07015e6a4386c6cc1a36612c17d54eb5/libstring/libstring.go

github.com

https://github.com/didip/tollbooth/pull/99

github.com

https://github.com/ulule/limiter/blob/9ba030af6009ca2bc9a285dbd815bc7a76de724a/network.go

github.com

https://pkg.go.dev/net

pkg.go.dev

https://go.dev/play/p/8bgVfOy4Lkw

go.dev

https://github.com/ulule/limiter/pull/181

github.com

https://github.com/sethvargo/go-limiter/blob/d0c1f4df450eb46623c6f3afe9f675d40da52cf9/httplimit/middleware.go

github.com

https://github.com/sethvargo/go-limiter/blob/67fff5ee8978ea6218af4d1354bb842096a5b543/httplimit/middleware.go

github.com

https://github.com/letsencrypt/boulder/blob/ab79f96d7bfc94be7d009e2aa2007c51ddf16f31/web/context.go

github.com

https://github.com/eclipse/jetty.project/blob/cb127793e5d8b5c5730b964392a9a905ba49191d/jetty-server/src/main/java/org/eclipse/jetty/server/ForwardedRequestCustomizer.java

github.com

https://expressjs.com/en/guide/behind-proxies.html

expressjs.com

https://doc.traefik.io/traefik/middlewares/http/ratelimit/

doc.traefik.io

https://github.com/phpList/phplist3/blob/927ce341068d16f35566eaaddf2b9ace639885a4/public_html/lists/admin/lib.php

github.com

https://github.com/phpList/phplist3/blob/927ce341068d16f35566eaaddf2b9ace639885a4/public_html/lists/admin/index.php

github.com

https://gitlab.torproject.org/tpo/anti-censorship/rdsys/-/issues/80

gitlab.torproject.org

https://old.reddit.com/r/golang/comments/toynmv/rfc_get_the_real_client_ip_the_right_ways/i28ibey/

old.reddit.com

https://github.com/gorilla

github.com

https://github.com/gorilla/mux

github.com

https://pkg.go.dev/github.com/gorilla/handlers

pkg.go.dev

https://github.com/gorilla/handlers/blob/v1.5.1/proxy_headers.go

github.com

https://github.com/gorilla/handlers/blob/d453effd20e6817a8acfd9d278dadd21371da0ba/proxy_headers.go

github.com

https://github.com/gorilla/handlers/issues/227

github.com

https://github.com/gorilla/handlers/pull/228

github.com

https://github.com/sebest/xff

github.com

https://github.com/sebest/xff/issues/6

github.com

https://github.com/sebest/xff/issues/14

github.com

https://github.com/sebest/xff/issues/15

github.com

https://github.com/pbojinov/request-ip

github.com

https://github.com/mo7zayed/reqip

github.com

https://github.com/stanvit/go-forwarded

github.com

https://github.com/stanvit/go-forwarded/issues/2

github.com

https://blog.ryanjarv.sh/2022/03/16/bypassing-wafs-with-alternate-domain-routing.html

blog.ryanjarv.sh

https://www.cloudflare.com/ips

cloudflare.com

https://search.arin.net/rdap/?query=104.30.0.1

search.arin.net

https://search.arin.net/rdap/?query=199.27.128.1

search.arin.net

https://adam-p.ca/img/blog/cloudflare-ip-range-removal-email.png

adam-p.ca

https://api.cloudflare.com/

api.cloudflare.com

https://bishopfox.com/blog/json-interoperability-vulnerabilities

bishopfox.com

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Host

developer.mozilla.org

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Proto

developer.mozilla.org

https://github.com/realclientip/realclientip-go

github.com

https://news.ycombinator.com/item?id=30570053

news.ycombinator.com

https://news.ycombinator.com/item?id=30571412

news.ycombinator.com

https://docs.rs/http/0.2.6/http/header/struct.HeaderMap.html

docs.rs

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/x-forwarded-headers.html

docs.aws.amazon.com

https://news.ycombinator.com/item?id=30571542

news.ycombinator.com

https://pkg.go.dev/net/http/httputil

pkg.go.dev

https://github.com/golang/go/issues/50465

github.com

https://github.com/caddyserver/caddy/pull/4507

github.com

https://news.ycombinator.com/item?id=30571219

news.ycombinator.com

https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_conn_man/headers

envoyproxy.io

https://esd.io/blog/flask-apps-heroku-real-ip-spoofing.html

esd.io

https://news.ycombinator.com/item?id=30574577

news.ycombinator.com

https://news.ycombinator.com/item?id=30572614

news.ycombinator.com

https://old.reddit.com/r/programming/comments/t7lxeb/the_perils_of_the_real_client_ip_or_all_the_wrong/hzka9ma/

old.reddit.com

https://old.reddit.com/r/programming/comments/t7lxeb/the_perils_of_the_real_client_ip_or_all_the_wrong/hzkmxie/

old.reddit.com

https://github.com/rod-hynes

github.com

https://psiphon.ca

psiphon.ca

https://old.reddit.com/r/programming/comments/t7lxeb/the_perils_of_the_real_client_ip_or_all_the_wrong/hzkg18l/

old.reddit.com

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-troubleshooting.html

docs.aws.amazon.com

https://datatracker.ietf.org/doc/html/rfc7540

datatracker.ietf.org

https://old.reddit.com/r/programming/comments/t7lxeb/the_perils_of_the_real_client_ip_or_all_the_wrong/hzits6h/

old.reddit.com

https://nodejs.org/api/http.html

nodejs.org