Is x-forwarded-for safe?

[jacobrobertsbaca]

This section of the docs mentions using the x-forwarded-for header to get the client IP address in Postgres. However after a brief test, it seems that this header can be spoofed.

For example, we can make a simple RPC:

create or replace function client_ip() returns text as $$
begin
  return split_part(
    (current_setting('request.headers', true)::json->>'x-forwarded-for')::text,
    ',',
    1
  );
end;
$$ language plpgsql;

and then curl with a spoofed header:

curl '<project_url>/rest/v1/rpc/client_ip' \
  -H 'apikey: <api_key>' \
  -H 'Content-Type: application/json' \
  -H 'X-Forwarded-For: spoofed' \
  --data-raw '{}'

will print out spoofed.

---

I am using x-forwarded-for to implement IP-banning for a project I am working on and I need to get a trustworthy value for the requester IP. Is this behaviour intended? Considering this approach was listed under the page called "Securing your API", I would have expected this header to have been forcibly overriden with the real IP when Supabase processed the request.

[jacobrobertsbaca]

Upon further inspection, when the client overwrites the x-forwarded-for header, the real IP is concatenated with the spoofed one as a proxy, e.g.:

x-forwarded-for: spoofed,68.65.164.215

but the Cloudflare header:

cf-connecting-ip: 68.65.164.215

contains the real IP. Should I prefer cf-connecting-ip over x-forwarded-for and is this header reliable? Or alternatively, is there a reliable way to parse x-forwarded-for to handle spoofing?