# Source: https://www.aptible.com/docs/core-concepts/apps/connecting-to-apps/app-endpoints/https-endpoints/http-request-headers.md

> ## Documentation Index
> Fetch the complete documentation index at: https://www.aptible.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# HTTP Request Headers

[HTTP(S) Endpoints](/core-concepts/apps/connecting-to-apps/app-endpoints/https-endpoints/overview) set standard HTTP headers to identify the original IP address of clients making requests to your Apps and the protocol they used:

<Note> Aptible Endpoints only allows headers composed of English letters, digits, hyphens, and underscores. If your App headers contain characters such as periods, you can allow this with `aptible config:set --app "$APP_HANDLE" "IGNORE_INVALID_HEADERS=off"`.</Note>

# `X-Forwarded-Proto`

This represents the protocol the end-user used to connect to your app. The value can be `http` or `https`.

# `X-Forwarded-For`

This represents the IP Address of the end-user connected to your App.

The `X-Forwarded-For` header is structured as a comma-separated list of IP addresses. It is generated by proxies that handle the request from an end-user to your app (each proxy appends the client IP they see to the header).

Here are a few examples:

## ALB Endpoint, users connect directly to the ALB

In this scenario, the request goes through two hops when it enters Aptible: the ALB, and an Nginx proxy. This means that the ALB will inject the client's IP address in the header, and Nginx will inject the ALB's IP address in the header.

In other words, the header will normally look like this: `$USER_IP,$ALB_IP`.

However, be mindful that end-users may themselves set the `X-Forwarded-For` in their request (typically if they're trying to spoof some IP address validation performed in your app). This means the header might look like this: `$SPOOFED_IP_A,$SPOOFED_IP_B,$SPOOFED_IP_C,$USER_IP,$ALB_IP`.

When processing the `X-Forwarded-For` header, it is important that you always start from the end and work you way back to the IP you're looking for. In this scenario, this means you should look at the second-to-last IP address in the `X-Forwarded-For` header.

## ALB Endpoint, users connect through a CDN

Assuming your CDN only has one hop (review your CDN's documentation for `X-Forwarded-For` if you're unsure), the `X-Forwarded-For` header will look like this: `$USER_IP,$CDN_IP,$ALB_IP`.

Similarly to the example above, keep in mind that the user can inject arbitrary IPs at the head of the list in the `X-Forwarded-For` header. For example, the header could look like this: `$SPOOFED_IP_A,$SPOOFED_IP_B,$USER_IP,$CDN_IP,$ALB_IP`.

So, in this case, you need to look at the third-to-last IP address in the `X-Forwarded-For` header.

## ELB Endpoint

ELB Endpoints have one less hop than ALB Endpoints. In this case, the client IP is the last IP in the `X-Forwarded-For` header.