#1 is actually another issue in itself. You should never blindly accept X-Forwarded-For. Why would you let the client modify its own IP address? X-Forwarded-For

#1 is actually another issue in itself. You should never blindly accept X-Forwarded-For. Why would you let the client modify its own IP address? X-Forwarded-For is used to allow proxies (such as nginx) to forward the client’s IP so that the application server uses the client IP and not the intermediate proxy IP. For example, with NodeJS Express, by default it only accepts X-Forwarded-For from local requests. You can add additional IPs or ranges so you can “trust” the header from your load balancer as well, or make it trust X number of hops. I’m sure other web servers have something similar.