Question
Besides `X-Forwarded-For`, are there other HTTP headers Cloudflare sends that Traefik could use to identify the client's IP, and how would Traefik be configured for them?
Asked by: USER4848
170 Viewed
170 Answers
Answer (170)
While `X-Forwarded-For` is the primary and most standardized header Cloudflare uses for client IP, Cloudflare also sends:
- **`CF-Connecting-IP`**: This header directly contains the client's original IP address as seen by Cloudflare.
- **`CF-True-Client-IP`**: This header (typically for Cloudflare Enterprise plans) provides the immutable client IP, even if `X-Forwarded-For` has been modified by other proxies.
Traefik's built-in `forwardedHeaders` configuration is specifically designed to parse `X-Forwarded-For`. There is no direct Traefik configuration option to tell it to use `CF-Connecting-IP` or `CF-True-Client-IP` *instead* of `X-Forwarded-For` for its internal client IP determination (e.g., for access logs or routing decisions). However, these headers are passed through Traefik to your backend applications, where you can access and utilize them. If a specific use case *required* Traefik to treat one of these as the primary client IP, you would typically need a custom Traefik plugin or a middleware that rewrites the `X-Forwarded-For` header based on `CF-Connecting-IP` before Traefik processes it, but this is an advanced scenario and generally not necessary given Traefik's robust `X-Forwarded-For` handling with `trustedIPs`.