If we extend the scenario from hombre_fatal's example to include IP spoofing like in that wikipedia article you linked, you end up with IP: <Heroku's load ba

If we extend the scenario from hombre_fatal's example to include IP spoofing like in that wikipedia article you linked, you end up with IP: <Heroku's load balancer addr> X-Forwarded-For: <Spoofed addr>, <Real user addr>, <Cloudflare addr> So you either need to know the number of proxies that you trust that are in between you and the user, or you need to know the IP addresses of those trusted proxies, in order to determine which parts of X-Forwaded-For to trust.