CODEWITHSUNDEEP
asp.net
Martin Randall
Martin Randall

Reputation: 328

Is there a difference between Request.ServerVariables["HTTP_X_FORWARDED_FOR"] and Request.Headers["X-Forwarded-For"]?

In ASP.NET, is there a difference between these?

  1. HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"]
  2. HttpContext.Current.Request.Headers["X-Forwarded-For"]

Request.Headers is clearer to me, but I commonly see sample code using Request.ServerVariables["HTTP_X_FORWARDED_FOR"] (along with Request.ServerVariables["REMOTE_ADDR"]) and I don't understand why.

Upvotes: 11

Views: 4430

Answers (1)

Gabriel Luci
Gabriel Luci

Reputation: 40948

There is no difference between Request.ServerVariables["HTTP_X_FORWARDED_FOR"] and Request.Headers["X-Forwarded-For"].

The documentation for the IIS Server Variables starting with "HTTP_" says: "The value stored in the header ."

So Request.ServerVariables["HTTP_X_FORWARDED_FOR"] just returns the X_Forwarded_For header. Nothing else.

The difference between HTTP_X_FORWARDED_FOR and REMOTE_ADDR is only apparent when there is a proxy server between you and the client. In those cases, REMOTE_ADDR will have the address of the proxy server, and HTTP_X_FORWARDED_FOR will have the address of the end client.

If there is no proxy, then HTTP_X_FORWARDED_FOR will be empty and REMOTE_ADDR will have the address of the end client.

Upvotes: 16

Related Questions