# Reverse Proxy Security **URL:** \ **Category:** NGINX\ **Created:** [April 23, 2010, 12:09am UTC](https://www.ruby-forum.com/t/reverse-proxy-security/187427 "2010-04-23T00:09:53Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![karmaboy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/49beb7/32.png) [@karmaboy](https://www.ruby-forum.com/u/karmaboy)\ **Post date:** [April 23, 2010, 12:09am UTC](https://www.ruby-forum.com/t/reverse-proxy-security/187427/1 "2010-04-23T00:09:53Z")
When using nginx as reverse proxy, to determine the actual client IP address I would need to rely on the X-Real-IP header. Since this is just an HTTP header than can be faked, is it possible for a visitor to include an X-Real-IP header value of their own, passing a fake IP to the back-end server? Does nginx always overwrite this value with the one it detects? Thx Posted at Nginx Forum: > **[Reverse Proxy Security](https://forum.nginx.org/read.php?2,78144,78144#msg-78144)** > > When using nginx as reverse proxy, to determine the actual client IP address I would need to rely on the X-Real-IP header. Since this is just an HTTP header than can be faked, is it possible for a visitor to include an X-Real-IP header value of their... ---
**Author:** ![karmaboy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/49beb7/32.png) [@karmaboy](https://www.ruby-forum.com/u/karmaboy)\ **Post date:** [April 23, 2010, 5:47am UTC](https://www.ruby-forum.com/t/reverse-proxy-security/187427/2 "2010-04-23T05:47:05Z")
You may choose a unusual Header name. On Fri, Apr 23, 2010 at 6:09 AM, karmaboy [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > [mailman.nginx.org archive](http://nginx.org/mailman/listinfo/nginx) – Ren Xiaolei ---
**Author:** ![karmaboy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/49beb7/32.png) [@karmaboy](https://www.ruby-forum.com/u/karmaboy)\ **Post date:** [April 23, 2010, 8:33am UTC](https://www.ruby-forum.com/t/reverse-proxy-security/187427/3 "2010-04-23T08:33:19Z")
On Fri, Apr 23, 2010 at 05:46, 任晓磊 [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > You may choose a unusual Header name. security by obscurity… ---
**Author:** ![karmaboy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/49beb7/32.png) [@karmaboy](https://www.ruby-forum.com/u/karmaboy)\ **Post date:** [April 24, 2010, 9:27pm UTC](https://www.ruby-forum.com/t/reverse-proxy-security/187427/4 "2010-04-24T21:27:35Z")
Thanks for the replies. Always writing is the behavior I would expect, so I’ll test for that and go with it. Posted at Nginx Forum: > **[Re: Reverse Proxy Security](https://forum.nginx.org/read.php?2,78144,78908#msg-78908)** > > When using nginx as reverse proxy, to determine the actual client IP address I would need to rely on the X-Real-IP header. Since this is just an HTTP header than can be faked, is it possible for a visitor to include an X-Real-IP header value of their... ---
**Author:** ![karmaboy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/49beb7/32.png) [@karmaboy](https://www.ruby-forum.com/u/karmaboy)\ **Post date:** [April 23, 2010, 8:40am UTC](https://www.ruby-forum.com/t/reverse-proxy-security/187427/5 "2010-04-23T08:40:55Z")
On Thu, Apr 22, 2010 at 06:09:28PM -0400, karmaboy wrote: > When using nginx as reverse proxy, to determine the actual client IP address I would need to rely on the X-Real-IP header. Since this is just an HTTP header than can be faked, is it possible for a visitor to include an X-Real-IP header value of their own, passing a fake IP to the back-end server? Does nginx always overwrite this value with the one it detects? Yes, nginx always overwrites a header if you set it in proxy\_set\_header. – Igor S. > **[Igor Sysoev](http://sysoev.ru/en/)**