In settings.php I've done the following:

/* Turn on reverse proxy */

$settings['reverse_proxy'] = TRUE;

/* Set reverse proxy (load balancer) address */

$settings['reverse_proxy_addresses'] = ['a.b.c.d']; //test-bnc4-web1

/* Enabled trusted headers */

$settings['reverse_proxy_trusted_headers'] = \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_FOR | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_HOST | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PORT | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PROTO | \Symfony\Component\HttpFoundation\Request::HEADER_FORWARDED;

I'm still not getting the correct client IP in the log when a user fails to login because of an invalid username. It is reporting the second IP address in $_SERVER['X_FORWARDED_FOR'] where $_SERVER['X_FORWARDED_FOR'] = 'a.b.c.d, e.f.g.h' The first IP is the correct one. The second is a switch.

This is important if an IP gets blocked.

  • Is the reverse proxy actually setting two IP addresses in X_FORWARDED_FOR?
    – mona lisa
    Commented Sep 16, 2022 at 15:15
  • I think I'm wrong about there being only one IP in this header: en.wikipedia.org/wiki/X-Forwarded-For. I am going to withdraw my answer. It looks like there is a Drupal 7 issue for this however at a glance I can't find one for Drupal 9. The Symfony function getClientIP is aware of this and is supposed to return the leftmost IP api.drupal.org/api/drupal/… so I don't know what is going on with flood control.
    – mona lisa
    Commented Sep 16, 2022 at 18:24

1 Answer 1


Based on this Symfony Framework pull request, you have to add all intermediate proxies to reverse_proxy_addresses for the actual client IP to resolve properly.

The documentation in settings.php above reverse_proxy_addresses reads:

In order for this setting to be used you must specify every possible reverse proxy IP address in $settings['reverse_proxy_addresses'].

  • You mean X_FORWARDED_FOR can only have one value? Commented Sep 16, 2022 at 17:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.