# HTTP\_X\_FORWARDED\_FOR being truncated/prefixed with a comma and no IP for some requests

**URL:** <https://www.ruby-forum.com/t/http-x-forwarded-for-being-truncated-prefixed-with-a-comma-and-no-ip-for-some-requests/246240>\
**Category:** NGINX\
**Created:** [September 19, 2013, 1:51am UTC](https://www.ruby-forum.com/t/http-x-forwarded-for-being-truncated-prefixed-with-a-comma-and-no-ip-for-some-requests/246240 "2013-09-19T01:51:08Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sadaf\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/858c86/32.png) [@Sadaf\_N](https://www.ruby-forum.com/u/Sadaf_N)\
**Post date:** [September 19, 2013, 1:51am UTC](https://www.ruby-forum.com/t/http-x-forwarded-for-being-truncated-prefixed-with-a-comma-and-no-ip-for-some-requests/246240/1 "2013-09-19T01:51:08Z")

</div>

Hi -

I have confirmed an unusual situation in which it appears the leading  
address is being stripped from x-forwarded-for headers passed on to  
downstream hosts (running Apache in this case) on very specific  
requests. I  
haven’t been able to determine a pattern that triggers the event.

Has anyone else experienced this issue/seen anything similar? I’ve been  
managing nginx-based services for some time and this is the first event  
in  
which I’ve seen this behavior; I am at a loss.

Kind regards,  
Stu

Technical info:  
Example:  
HTTP\_X\_FORWARDED\_FOR=, 10.2.8.141 SERVER\_ADDR=10.5.7.112  
REMOTE\_ADDR=10.4.7.114

- note the leading “,” on the x\_forwarded\_for header and the missing  
leading  
IP.

Configuration example:  
location / {  
proxy\_set\_header X-Real-IP $remote\_addr;  
proxy\_set\_header X-Forwarded-Host $host;  
proxy\_set\_header X-Forwarded-Server $host;  
proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;  
proxy\_set\_header Host $host;  
proxy\_pass [http://backend1/](http://backend1/);  
}  
}

Version info:  
nginx version: nginx/1.2.6 (Ubuntu)  
TLS SNI support enabled  
configure arguments: --prefix=/usr/share/nginx  
–conf-path=/etc/nginx/nginx.conf  
–error-log-path=/var/log/nginx/error.log  
–http-client-body-temp-path=/var/lib/nginx/body  
–http-fastcgi-temp-path=/var/lib/nginx/fastcgi  
–http-log-path=/var/log/nginx/access.log  
–http-proxy-temp-path=/var/lib/nginx/proxy  
–http-scgi-temp-path=/var/lib/nginx/scgi  
–http-uwsgi-temp-path=/var/lib/nginx/uwsgi  
–lock-path=/var/lock/nginx.lock  
–pid-path=/run/nginx.pid --with-pcre-jit --with-debug  
–with-http\_addition\_module --with-http\_dav\_module  
–with-http\_geoip\_module  
–with-http\_gzip\_static\_module --with-http\_image\_filter\_module  
–with-http\_realip\_module --with-http\_stub\_status\_module  
–with-http\_ssl\_module --with-http\_sub\_module --with-http\_xslt\_module  
–with-ipv6 --with-sha1=/usr/include/openssl  
–with-md5=/usr/include/openssl  
–with-mail --with-mail\_ssl\_module  
–add-module=/tmp/buildd/nginx-1.2.6/debian/modules/nginx-auth-pam  
–add-module=/tmp/buildd/nginx-1.2.6/debian/modules/nginx-echo  
–add-module=/tmp/buildd/nginx-1.2.6/debian/modules/nginx-upstream-fair  
–add-module=/tmp/buildd/nginx-1.2.6/debian/modules/nginx-dav-ext-module

Posted at Nginx Forum:

> **[HTTP\_X\_FORWARDED\_FOR being truncated/prefixed with a comma and no IP for some...](https://forum.nginx.org/read.php?2,242970,242970#msg-242970)**
>
> Hi - I have confirmed an unusual situation in which it appears the leading address is being stripped from x-forwarded-for headers passed on to downstream hosts (running Apache in this case) on very specific requests. I haven't been able to determine...

---

<div class="post-metadata">

**Author:** ![scianos](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/f04885/32.png) [@scianos](https://www.ruby-forum.com/u/scianos)\
**Post date:** [September 19, 2013, 12:36pm UTC](https://www.ruby-forum.com/t/http-x-forwarded-for-being-truncated-prefixed-with-a-comma-and-no-ip-for-some-requests/246240/2 "2013-09-19T12:36:53Z")

</div>

Hello!

On Wed, Sep 18, 2013 at 07:50:13PM -0400, scianos wrote:

> Kind regards,  
> Stu
> 
> Technical info:  
> Example:  
> HTTP\_X\_FORWARDED\_FOR=, 10.2.8.141 SERVER\_ADDR=10.5.7.112  
> REMOTE\_ADDR=10.4.7.114
> 
> - note the leading “,” on the x\_forwarded\_for header and the missing leading  
> IP.

This can easily happen if an original request contains an empty  
X-Forwarded-For header. See no problem here.

–  
Maxim D.

> **[nginx: donation](http://nginx.org/en/donation.html)**