I'm setting up Nginx as a caching HTTP server for Steam and Origin game downloads on my LAN.

Is it necessary for Nginx to send the X-Real-IP and X-Forwarded-For headers to the servers, if:

  • The IP addresses will always be RFC1918 addresses (192.168, 172.16, 10.)
  • No state needs to be tracked by the upstream content servers

If it is unlikely to cause problems, I'd like to disable sending these headers to save a tiny amount of bandwidth.

Many thanks

  • X-Real-IP and X-Forwarded-For are meant to be used when nginx is a reverse proxy. I haven't even seen that nginx would be used as a forward proxy... Dec 4 '16 at 2:25
  • he's still using it as a reverse proxy to MITM Cache game content Dec 4 '16 at 18:26

No, you don't need them.

As a security precaution, the actual host will remove these values to prevent IP spoofing, and may use any value they choose (X- headers are custom and can be anything)

  • Removed by nginx or the upstream server?
    – ilumos
    Dec 4 '16 at 1:59
  • by whatever device they use, it's standard security to unset these headers to prevent spoofing Dec 4 '16 at 2:07

X-Real-IP and X-Forwarded-For are not part of RFCs but rather conventions established mostly for reverse proxies to communicate the actual IP of the user so the web app knows the user's IP.

It is not required at all that you add those headers in your proxy, especially if you do not own the servers on the other side, since it's mostly useful for yourself.

  • owning the servers isn't relevant, as many DDOS mitigation companies like cloudflare, akamai, incapsula.... set these values. Dec 4 '16 at 18:29
  • sure, but they act as if they were in your infrastructure and this is their way to do so
    – Xowap
    Dec 4 '16 at 19:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.