trustedproxy

Trustedproxy is a concept referring to a proxy server or set of proxies that are explicitly trusted by an origin system to forward client requests and convey client identity information. In modern web architectures, trusted proxies are usually reverse proxies, load balancers, or content delivery networks positioned between clients and application servers. They terminate client connections, perform tasks such as TLS termination, request routing, caching, and authentication, and attach metadata such as the client IP to requests, typically via headers like X-Forwarded-For or X-Real-IP. The receiving application must be configured to trust only these proxies to avoid header spoofing.

Configuration and operation: Operators maintain an allowlist of trusted proxy IP addresses or networks. Applications and frameworks provide settings to respect the proxy chain, ensuring the application uses the original client IP rather than the last hop’s address. Some proxies also pass protocol information using X-Forwarded-Proto, which the app can use to generate correct redirects and links.

Security and reliability: The trust boundary rests on the integrity of the proxy layer. Compromising a trusted proxy can expose internal addresses, modify requests, or bypass access controls. Best practices include strong authentication for proxy access, incoming-request validation, header handling that prevents header spoofing, encryption of proxy-to-origin traffic, and comprehensive logging and monitoring. Redundancy and proper failover reduce single points of failure.

Examples and implementations: Common trusted proxies include Nginx and HAProxy, as well as CDNs and cloud load balancers such as Cloudflare or AWS Elastic Load Balancing. In software development, frameworks provide explicit trusted proxy configurations—for instance, Laravel’s TrustedProxy feature and Express.js's trust proxy setting—to ensure applications correctly derive the client IP from the proxy chain.