Is there a difference between Request.ServerVariables["HTTP_X_FORWARDED_FOR"] and Request.Headers["X-Forwarded-For"]?

Question

In ASP.NET, is there a difference between these?

1. HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"]
2. HttpContext.Current.Request.Headers["X-Forwarded-For"]

Request.Headers is clearer to me, but I commonly see sample code using Request.ServerVariables["HTTP_X_FORWARDED_FOR"] (along with Request.ServerVariables["REMOTE_ADDR"]) and I don't understand why.

Answer 1

There is no difference between Request.ServerVariables["HTTP_X_FORWARDED_FOR"] and Request.Headers["X-Forwarded-For"].

The documentation for the IIS Server Variables starting with "HTTP_" says: "The value stored in the header ."

So Request.ServerVariables["HTTP_X_FORWARDED_FOR"] just returns the X_Forwarded_For header. Nothing else.

The difference between HTTP_X_FORWARDED_FOR and REMOTE_ADDR is only apparent when there is a proxy server between you and the client. In those cases, REMOTE_ADDR will have the address of the proxy server, and HTTP_X_FORWARDED_FOR will have the address of the end client.

If there is no proxy, then HTTP_X_FORWARDED_FOR will be empty and REMOTE_ADDR will have the address of the end client.