Reliably access client IP address behind Azure Front Door

[sciguy16]

Hi, I'm looking at the documentation for the X-Azure-ClientIP and X-Azure-SocketIP headers and it's not completely clear to me how they will behave if a client sends a request with their own value for these. X-Forwarded-For explicitly states that Front Door will append an additional value if the incoming request includes one, and X-Azure-SocketIP suggests that X-Azure-ClientIP might get overwritten by a user.

What's the recommended way to get the client's IP address in an application behind Azure Front Door while discarding/ignoring user-submitted values?

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 1c44a91d-f0a9-99cb-1ba6-a4a0918c1b8f
• Version Independent ID: 3c43384c-6fce-25b0-eabb-49ba7667034b
• Content: Protocol support for HTTP headers in Azure Front Door
• Content Source: articles/frontdoor/front-door-http-headers-protocol.md
• Service: frontdoor
• GitHub Login: @duongau
• Microsoft Alias: duau

[SaiKishor-MSFT]

Thanks for the feedback! We are currently investigating and will update you shortly.

[SaiKishor-MSFT]

Thanks for leveraging Azure docs feedback channel to raise this question. This channel is reserved for ‘Azure docs’ feedback- for sharing doc feedback and suggesting content improvements. We didn't determine any changes for this documentation upon reviewing this feedback.
If your issue is specific to a use case, we request you to please reach out in forums like Microsoft Q&A or Stackoverflow. We have our engineers and other community members who will be happy to assist. Forums have a better suited audience for such queries. Once your issue is posted in forum, please do share the forum thread link here for tracking.
If you have a document which you are following and if you think it needs an update, please let us know about that here.
Thank you!

[sciguy16]

@SaiKishor-MSFT Yes, I'm only interested in the values added by Front Door, because other values can easily be spoofed by end users. How do the X-Azure-ClientIP and X-Azure-SocketIP headers behave when an incoming request already has values set for them?