Not really. A spoofed ip during handshake will fail. course, unless OP configures the log file format such that Nginx is told to log something not the real ip a

Not really. A spoofed ip during handshake will fail. course, unless OP configures the log file format such that Nginx is told to log something not the real ip address. If your user enters your load balancer/proxy server (e.g. Nginx) and then you forward that HTTP request to your backend, the backend sees the ip address of your load balancer/proxy server, but conventionally you can set X-Forwarded-For header, then backend can read the X-Forward-For and "trust" that's the original IP. But this header can be set to whatever the value you want, if you have the control of the load balancer/proxy server. You can also