# Handling the "chain of trust" of the end user's real IP

**URL:** https://meta.discourse.org/t/handling-the-chain-of-trust-of-the-end-users-real-ip/406372
**Category:** Self-Hosting
**Tags:** docker, how-to
**Created:** [29 juni 2026 om 16:57 UTC](https://meta.discourse.org/t/handling-the-chain-of-trust-of-the-end-users-real-ip/406372 "2026-06-29T16:57:59Z")
**Posts on this page:** 1
**Showing post:** 6

<div class="post-metadata">

### Author: ![MichaIng](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/michaing/32/251089_2.png) [@MichaIng](https://meta.discourse.org/u/MichaIng)
#### Post date: [1 juli 2026 om 14:37 UTC](https://meta.discourse.org/t/handling-the-chain-of-trust-of-the-end-users-real-ip/406372/6 "2026-07-01T14:37:17Z")

</div>

Got it, so it is more about what Rails or other gems do with the headers, and less about what Discourse code does.

Interesting that Rails does not make use of `X-Real-IP`, which is probably less commonly used than `X-Forwarded-For`, but certainly better known than `Forwarded` and `Client-IP` 🤔.

Probably `X-Real-IP` is then obsolete in the Nginx config. Discourse expands uses it along with `X-Forwarded-For` in logs, if I interpret it correctly? I couldn’t find any other explicit use/mention in the code:

- [discourse/lib/discourse\_logstash\_logger.rb at main · discourse/discourse · GitHub](https://github.com/discourse/discourse/blob/main/lib/discourse_logstash_logger.rb#L38-L47)
- [logster/lib/logster/message.rb at main · discourse/logster · GitHub](https://github.com/discourse/logster/blob/main/lib/logster/message.rb#L9-L22)

The below just looked wrong in two ways when I saw it while debugging shared rate limiting and logged errors about the invalid “unix:” client IP after our Discourse upgrade (we use a UNIX socket proxy in front of the container and do rely on `X-Forwarded-For`).

```sh
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr;

```

But I get the “it works” to reliably make `$remote_addr` the only point of truth, and `real_ip_header` the canonical way for admins to control the single IP Discourse/Rails gets. I see it was added to [Serve Discourse from a subfolder (path prefix) instead of a subdomain](https://meta.discourse.org/t/serve-discourse-from-a-subfolder-path-prefix-instead-of-a-subdomain/30507) already 👍.

---

_[View the full topic](https://meta.discourse.org/t/handling-the-chain-of-trust-of-the-end-users-real-ip/406372)._