RFC 7239 / START HERE
Forwarded HTTP, before the details
Forwarded is the HTTP request field name, not an acronym. A proxy receives a request and forwards it on another connection; a reverse proxy does this in front of an origin server.
A server behind a proxy sees the proxy as its immediate network peer. Forwarded lets participating proxies report earlier connection details such as who connected, which host was requested and which protocol was used.
The idea in one picture
Observe a hop
Append a group
Check the boundary
A simplified picture of the idea; the chapters explain the actual mechanisms.
Why it exists
It standardizes grouped proxy observations that would otherwise be lost or carried in inconsistent X-Forwarded-* fields. Use is optional and privacy-sensitive; the field should be off by default, with parameters configured individually.
A familiar example
A public HTTPS edge forwards a request to a backend. It can report the incoming public host and https scheme, while the backend separately checks which proxy it trusts. A readable Forwarded field is not proof of client identity or end-to-end encryption.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Follow the request through participating proxiesA proxy forwards a request on a client’s behalf. Forwarded can report details that would otherwise be hidden by those separate connections.→
- Keep pairs together and preserve list orderSemicolons join parameters for one proxy observation. Commas separate observations, except inside a quoted string.→
- Spell node identifiers and quote their boundariesThe for and by values use a node identifier: an address, unknown, or an underscore-prefixed opaque label, with an optional port.→
- Separate the original host and protocol from the next hopA reverse proxy may receive HTTPS for a public host and forward HTTP with a different Host value. Forwarded can report what that proxy received.→
- Apply trust and privacy decisions at the boundaryA client can write a Forwarded field too. Correct syntax cannot make an inherited chain trustworthy or make disclosure harmless.→
This introduction explains RFC 7239 (2014). Read the original RFC ↗