The server should only accept the header from trusted proxies (like nginx, your load balancer, etc). If #1 is possible, you have a bigger problem of letting the

The server should only accept the header from trusted proxies (like nginx, your load balancer, etc). If #1 is possible, you have a bigger problem of letting the client send any arbitrary IP.