API Testing · Senior · Question 74 of 75
What does a test for X-Forwarded-For spoofing check?
- 1That proxies add the header to every response they send
- 2That clients can't bypass IP-based limits by faking the header
- 3That the header value is always longer than one IP address
Show the answer
Correct answer: That clients can't bypass IP-based limits by faking the header
Explanation
If the API trusts any client-supplied X-Forwarded-For, attackers rotate fake IPs to escape rate limits or allow-lists. Only trusted proxies should set it.