Intermediate LevelREST APIs & Web Services
How does the PROXY protocol preserve true client IP addresses through load balancers?
❓ Interview Prompt: Explain client IP preservation, `X-Forwarded-For` header spoofing risks, PROXY protocol v1/v2, and layer 4 TCP metadata forwarding.
When API traffic passes through reverse proxies or load balancers (AWS ALB, NGINX), the backend server sees the load balancer's IP address instead of the true client IP:
2 Solutions:
1
'X-Forwarded-For' Header: Added by Layer 7 HTTP proxies ('X-Forwarded-For: client_ip, proxy1_ip'). Risk: Header can be spoofed if proxy chain is untrusted!
2
PROXY Protocol (Layer 4): Prepends a binary header carrying true client source IP and port before initiating TCP proxying, immune to HTTP header tampering!
Code Implementation Example
http
// PROXY Protocol v1 Header (Prepended to raw TCP stream before HTTP payload):
PROXY TCP4 203.0.113.195 70.41.3.18 56324 443
GET /api/v1/data HTTP/1.1💡PROXY protocol TCP metadata header preserving true client IP address.
🎯 Interview Key Takeaway
Use PROXY protocol or trusted X-Forwarded-For proxy chains to accurately capture client IP addresses for rate limiting and security.
#PROXY Protocol#Client IP#Load Balancers#Intermediate
Back to all REST APIs & Web Services Questions→