HTTP Headers
Forwarded
HTTP Header
The HTTP Forwarded request header provides information that may be added by reverse proxy servers such as load balancers and Content Delivery Networks (CDNs). This header helps preserve details that might otherwise be lost or altered when requests pass through multiple proxy servers.
For example, if a client connects to a web server via an HTTP proxy or load balancer, server logs typically record only the proxy’s IP address, host address, and protocol. The Forwarded header enables the server to identify the original client’s IP address, host, and protocol.
The header is optional and can be added, modified, or removed by any proxy server along the request path.
This header is useful for debugging purposes, collecting traffic statistics, and generating content based on the client’s location or device. However, since it may expose sensitive information like the client’s IP address, privacy considerations are essential when utilizing this header.
Common alternative standards for conveying this information include the headers X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Proto.
Syntax
Syntax
The forwarding header from a single proxy follows a specific syntax. It consists of directives formatted as key=value pairs, with each pair separated by a semicolon. This structure helps in conveying the original client’s information through proxies and load balancers.
http
Forwarded: by=<identifier>;for=<identifier>;host=<host>;proto=<http|https>When multiple proxy servers are involved between the client and the destination server, each proxy can include its own forwarding information. This is achieved either by adding a new Forwarded header at the end of the existing header block, or by appending the new information as a comma-separated list within the last Forwarded header.
Directives
Directives
byOptionalThe interface where the request originated and was received by the proxy server.
The identifier can be:- an obfuscated identifier (such as “hidden” or “secret”).
This is the default assumption. - an IP address (IPv4 or IPv6, optionally with a port, with IPv6 quoted and enclosed in square brackets).
- “unknown” when the preceding entity is not known, but you want to indicate that a forwarding action occurred.
- an obfuscated identifier (such as “hidden” or “secret”).
forOptionalThe client that initiated the request along with any subsequent proxies in the chain.
The identifier follows the same options as thebydirective.hostOptionalThe
Hostrequest header as received by the proxy.protoOptionalSpecifies the protocol used to make the request, typically “http” or “https”.
Example
Examples
Using the Forwarded header
http
Forwarded: for="_mdn"
# case insensitive
Forwarded: For="[2001:db8:cafe::17]]:4711"
# separated by semicolon
Forwarded: for=192.0.2.60;proto=http;by=203.0.113.43
# Values from multiple proxy servers can be appended using a comma
Forwarded: for=192.0.2.43, for=198.51.100.17
Transitioning from X-Forwarded-For to Forwarded
If your application, server, or proxy supports the standardized Forwarded header, the X-Forwarded-For header can be replaced.
http
X-Forwarded-For: 192.0.2.172
Forwarded: for=192.0.2.172
X-Forwarded-For: 192.0.2.43, 2001:db8:cafe::17
Forwarded: for=192.0.2.43, for="[2001:db8:cafe::17]"
How to Modify Header using Requestly
Requestly is a powerful Chrome extension that allows you to modify HTTP headers, including the Forwarded header. This is especially useful for testing how your server or application handles proxy and client information during development or troubleshooting. Steps to Modify the Forwarded Header:
- Install and open the Requestly Chrome extension. You can find it on the Chrome Web Store.
- Create a new rule: Click on “Create Rule” and choose “Modify Headers” from the list of available rule types.
- Add a new header modification:
- Under “Action”, select “Add” or “Override”.
- In the “Header Name” field, enter Forwarded.
- In the “Header Value” field, enter the desired value (e.g., for=192.0.2.43; proto=https; by=203.0.113.43).
- Set the URL condition: Specify the URL or pattern where this header change should apply (e.g., https://your-api.com/*).
- Save the rule.
Once set up, Requestly will inject the custom Forwarded header into all matching requests, letting you simulate different proxy forwarding scenarios to test how your backend interprets client information.
Table of Contents
- No headings found.
