The edge
Forwarded headers and trusted proxies
Blindly trusting X-Forwarded-For fills rate limits and logs with fake IPs.
Understand the concept
An application behind a proxy receives its TCP connection from the proxy, so HttpContext.Connection.RemoteIpAddress shows the proxy’s IP. The client’s real address travels in X-Forwarded-For and its scheme in X-Forwarded-Proto. In ASP.NET Core the ForwardedHeaders middleware reads these headers and corrects the connection information.
The catch: clients can send these headers too. If the app trusts every incoming X-Forwarded-For, an attacker writes a different fake IP on each request to dodge an IP-based rate limit or poison the logs. The headers must therefore be honoured only when they come from known, trusted proxies (KnownProxies or KnownNetworks).
The scheme matters as well. Because TLS terminates at the proxy, the app sees the request as http; redirect URLs, the cookie Secure flag and OAuth callback addresses can be generated wrongly. With X-Forwarded-Proto read correctly, the app knows the request was really https.
Rate limits, audit logs and secure cookies rely on correct client information.
Clearing KnownProxies and accepting forwarded headers from any source.
One topic. Three levels of depth.
X-Forwarded-For: 198.51.100.24, 10.0.0.5
# soldan sağa: istemci, sonra arada geçtiği vekillerThe header is a chain; each proxy appends the address before it.
This page connects to no real server or database. Code samples are illustrative for .NET 8, Next.js and SQL Server; timings are example values in the simulation, not measurements. Try samples only in your own development environment; never share real connection strings, tokens or passwords.
Try it yourself first.
The login endpoint is limited to 5 attempts per IP per minute, yet logs show an attacker arriving from 2000 different IPs at the same moment. What is the most likely explanation?
Show the solution and explanation
Uygulama istemcinin gönderdiği X-Forwarded-For’a güveniyor.
Saldırgan her istekte rastgele IP yazıyor.
Çözüm: KnownProxies/KnownNetworks ile yalnız gerçek vekile güvenmek.It could be 2000 machines, but identical simultaneous requests usually mean spoofed headers; check the trust boundary first.