ASVS 5.0 V15.3.4 requires that proxies and middleware pass the user's original IP address using fields the user cannot manipulate, and that the application uses that value for logging and decisions such as rate limiting. It is Level 2. Configure which proxies you trust, and read the forwarded header only from them.
Why it matters
If your app blindly trusts X-Forwarded-For, anyone can send their own value and appear to come from anywhere. That defeats per IP rate limits and poisons logs during an investigation. If it ignores the header, every request appears to come from your load balancer.
How to implement it
Tell the framework how many proxies sit in front of it, and nothing more.
// Express: exactly one trusted proxy hop
app.set("trust proxy", 1);
// req.ip now comes from the right most entry added by your proxy
For nginx, set the real IP only from known sources:
set_real_ip_from 10.0.0.0/8;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
At the edge proxy, overwrite the header rather than appending to client supplied values. Remember the value is still imperfect because of VPNs and shared corporate addresses, so combine it with account level limits.
How to test it
Send a request directly to the application with a forged X-Forwarded-For: 203.0.113.9. The logged client IP must not be that value. Then send one through the real proxy path with the same forged header and confirm the logged address is your actual test machine.
Common mistakes
- Enabling trust for all proxies.
- Taking the left most header entry, which the client controls.
- Rate limiting on the proxy address, which blocks everyone together.
Quick check
Which entry in X-Forwarded-For is safe?
The one appended by your own trusted proxy, counted from the right.
