1. Home
2. Reference documentation
3. HTTP references
4. HTTP Headers

X-Forwarded-For

For VCL services, Fastly will add or append X-Forwarded-For headers on incoming requests over TLS, as follows:

• The client IP – if the request protocol is TLS.
• The edge IP – if the origin has a TLS configuration and shielding is enabled.
• Even if client connection is TLS, unless the origin connection is over TLS, nothing will be added or appended at the shield.

The value is not protected from modification at the edge of the Fastly network, so if a client sets this header itself, we will use it. If you want to prevent this, set the value yourself in VCL:

if (fastly.ff.visits_this_service == 0 && req.restarts == 0) {
  set req.http.X-Forwarded-For = client.ip;
}

Examples

Overriding multiple entries

To set a single value for this header, add the following to vcl_miss and vcl_pass:

set bereq.http.X-Forwarded-For = client.ip;