What's the relation between load balancer and HTTP_X_FORWARDED_FOR?

Question

Here is my understanding of the user's IP:

User's IP is REMOTE_ADDR . But if the user is using a proxy (like HotSpotSheild (HSS)) or a chain of proxies, then REMOTE_ADDR is the address of the proxy (not user's IP) , and the user's IP might be in the other headers like these:

• HTTP_CLIENT_IP
• HTTP_X_FORWARDED_FOR
• HTTP_X_FORWARDED
• HTTP_X_CLUSTER_CLIENT_IP
• HTTP_FORWARDED_FOR
• HTTP_FORWARDED
• Or maybe none of them.

So when an user uses the proxy, then he is undetectable.

Question1: Always one of those headers (above) is full? And are the rest empty?

Question2: Is that a good idea that I store both REMOTE_ADDR and one of those header (which isn't empty) in different fields in the database? (I mean having two separated columns for the IP, not just one column)

---

Here is my understanding of a load balancer:

It is a reverse proxy server that you use when you're running a cluster of servers. Clients connect to the load balancer, and it forwards the connection to one of the actual servers.

---

Theory:

If you use a load balancer, use HTTP_X_FORWARDED_FOR as user's IP.

Question3 Why should I store bHTTP_X_FORWARDED_FOR as the user's IP when there is a load balancer? I mean what's bHTTP_X_FORWARDED_FOR to do with load balancer?

Answer 1

This is all about the notion of trust and specific implementation details.

If your system trusts the proxy server (eg in a reverse-proxy situation), then you can trust the IP it passes onto you in one of those HTTP headers.

If there is no reasons to trust the proxy server (eg a random internet proxy such as Hotspot Shield), then your system has no idea whether the IP passed to you is simply made up or not.

You could have a whitelist of servers you trust based on REMOTE_ADDR , and if you get a connection from one of those then you use the IP in the HTTP header instead (although probably best to log both for completeness). You may also wish to expand this so certain headers are trusted to be supplied by certain remote proxies, otherwise there may be a security flaw where a user supplies their own header as well that manages to pass through the proxy unscathed.

Always one of those headers (above) is full? And are the rest empty?

Depends on the proxy and its software implementation.

Is that a good idea that I store both REMOTE_ADDR and one of those header (which isn't empty) in different fields in the database? (I mean having two separated columns for the IP, not just one column)

Yes, there is no harm in storing both - they may be useful for any audit trails.

Why should I store bHTTP_X_FORWARDED_FOR as the user's IP when there is a load balancer? I mean what's bHTTP_X_FORWARDED_FOR to do with load balancer?

Because your load balancer should be a trusted proxy, therefore you should be able to trust the IP it provides to you.