X-Forwarded-For: the client address behind a proxy

Each proxy appends the address it received the connection from, so the list grows left to right and the leftmost entry claims to be the original client. That claim is the problem: a client can send the header itself, and every proxy in front of you will politely append to whatever was already there rather than discarding it.

The rule that works is to count hops from the right. If you know there are exactly two proxies you control between the internet and your application, the address of interest is the third from the end, and everything to the left of it was supplied by somebody else. Reading the first entry unconditionally means accepting whatever the client typed.

Getting this wrong is not academic. Rate limiting keyed on a forged leftmost address can be bypassed by rotating the value, and it can also be abused to block someone else by sending their address deliberately. Audit logs built from the same field inherit exactly the same problem, and they are usually the evidence you reach for afterwards.

Behind a proxy that does not add the header, everything appears to come from one address instead. That is the opposite failure and it is just as damaging: a single shared limit for every visitor, and access logs where every request comes from your own load balancer.