X-Real-IP, X-Forwarded-For and the WAF allowlist: an analysis of a dangerous misconfiguration

▤ Summary

This article explains how trusting X-Forwarded-For and X-Real-IP headers can let attackers spoof client IPs and bypass WAF allowlists. It walks through Nginx and HAProxy configuration examples to show how misconfigured real IP handling changes what the WAF sees. It also demonstrates how to fix the problem by using X-Real-IP carefully and by setting trusted headers only at the proxy layer. The piece is aimed at operators who need to harden reverse proxies, logging, and access-control rules against IP spoofing.

▦ Linked Companies