As dcdan said, before accepting any type of forwarded or proxy header, the remote address should be checked against a whitelist of acceptable proxies. This is how mod_extract_forwarded works for apache, for example. http://www.openinfo.co.uk/apache/index.html