# Improve user IP address detection for mobile users **URL:** \ **Category:** Feature\ **Created:** [22 Novembro , 2015 15:53 UTC](https://meta.discourse.org/t/improve-user-ip-address-detection-for-mobile-users/35908 "2015-11-22T15:53:34Z")\ **Posts on this page:** 1\ **Showing post:** 2
**Author:** ![mpalmer](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mpalmer/32/45740_2.png) [@mpalmer](https://meta.discourse.org/u/mpalmer)\ **Post date:** [22 Novembro , 2015 21:31 UTC](https://meta.discourse.org/t/improve-user-ip-address-detection-for-mobile-users/35908/2 "2015-11-22T21:31:27Z")
Unfortunately, using the contents of `X-Forwarded-For` on connections from random IP addresses is a significant security risk, as it allows attackers to mask their true source – since that header is client-controlled, an attacker can set it to whatever they like, and the webserver will use it instead of the real source IP. Standard practice is for proxy providers (such as Google) who run well-administered proxies that don’t allow `X-Forwarded-For` forging, to publish the IP address blocks they control from which such proxied traffic can originate, so that origin server operators can whitelist those address ranges and accept `X-Forwarded-For` for connections coming from those addresses. If and when Google publishes such a list, we’ll certainly use it in our hosted Discourse system, and we can look at adding the config to enable it for all DIscourse instances (as we already do for Cloudflare, for example). --- _[View the full topic](https://meta.discourse.org/t/improve-user-ip-address-detection-for-mobile-users/35908)._