Which header should be used X-Forwarded-For or Forwarded?
There are two headers to handle request forwarding. First is X-Forwarded-For and second is Forwarded.
Which one should I use? X-Forwarded-For is a de-facto whereas Forwarded
is an RFC-7239 standard.
There are no specific guidelines in the specification and I could not observe any general trend about this in the web development scope.
It seems nobody is interested in Forwarded
, still not in 2019. I would use it, but it's hard, as many tools and frameworks lack support...for example, today, the Django Framework (issue and discussion here) is still using X-Forwarded-XY
headers, to detect original IP/Host, etc. And there is no hurry ;-)
In the long term, Forwarded
will probably be adopted and the new standard, so, if you can, go with it. I would.