CODEWITHSUNDEEP
http-headers
finneycanhelp
finneycanhelp

Reputation: 9248

X-Forwarded-For (XFF) HTTP header

How many characters can the value of the X-Forwarded-For (XFF) HTTP header value be?

Example is: X-Forwarded-For: client1, proxy1, proxy2

Upvotes: 1

Views: 5355

Answers (2)

You
You

Reputation: 23794

AFAIK, there is no limit. Note that you shouldn't rely on its value; it can be spoofed easily. (Note however that if you're using a load-balancing proxy that overwrites this value, you can rely on it as you're setting it yourself)

Upvotes: 1

Oded
Oded

Reputation: 499092

See this, this and this (related SO questions).

The spec does not specify a limit (so, unlimited, in theory). However, there is a limit that is implementation specific.

IIS 6/7 allow up to 16K per header, apache will default to 8K.

Upvotes: 1

Related Questions