X-Forwarded-For

A de facto HTTP header used by proxies and load balancers to identify the originating client IP address when traffic passes through intermediaries. Each proxy appends the IP it received the request from, creating a comma-separated list. Applications must trust only the last untrusted hop to prevent IP spoofing — attackers can prepend arbitrary IPs to the header if the application naively reads the first value.