Drupal is a registered trademark of Dries Buytaert
drupal 11.3.7 Update released for Drupal core (11.3.7)! drupal 11.2.11 Update released for Drupal core (11.2.11)! drupal 10.6.7 Update released for Drupal core (10.6.7)! drupal 10.5.9 Update released for Drupal core (10.5.9)! cms 2.1.1 Update released for Drupal core (2.1.1)! drupal 11.3.6 Update released for Drupal core (11.3.6)! drupal 10.6.6 Update released for Drupal core (10.6.6)! cms 2.1.0 Update released for Drupal core (2.1.0)! bootstrap 8.x-3.40 Minor update available for theme bootstrap (8.x-3.40). menu_link_attributes 8.x-1.7 Minor update available for module menu_link_attributes (8.x-1.7). eca 3.1.1 Minor update available for module eca (3.1.1). layout_paragraphs 2.1.3 Minor update available for module layout_paragraphs (2.1.3). ai 1.3.3 Minor update available for module ai (1.3.3). ai 1.2.14 Minor update available for module ai (1.2.14). node_revision_delete 2.0.3 Minor update available for module node_revision_delete (2.0.3). moderated_content_bulk_publish 2.0.52 Minor update available for module moderated_content_bulk_publish (2.0.52). klaro 3.0.10 Minor update available for module klaro (3.0.10). klaro 3.0.9 Minor update available for module klaro (3.0.9). layout_paragraphs 2.1.2 Minor update available for module layout_paragraphs (2.1.2). geofield_map 11.1.8 Minor update available for module geofield_map (11.1.8).

reverse_proxy_header

1,821 sites Security covered
View on drupal.org

This module is the simplest way to use the specific HTTP header name to determine the client IP.

The module provides an equivalent of reverse_proxy_header setting (which is deprecated from Drupal 8.7.0).

The most common usage is:

  • real client IP is stored in some custom (non-default) header;
  • you cannot affect this on reverse proxy or server sides.

The module does not provide any UI. How to use it:
Step 1) Install the module via composer and enable it.
Step 2) Add the `reverse_proxy_header` configuration to your setting.php file:

/**
 * Sets the HTTP header name which stores the real client IP.
 *
 * @see https://www.drupal.org/project/reverse_proxy_header
 */
$settings["reverse_proxy_header"] = "HTTP_X_FORWARDED_FOR_CUSTOM_HEADER";

Here is an example for setting.php file to configure the module to use Cloudflare header only for some instances:

/**
 * Reverse Proxy Header module configuration.
 *
 * Determines the specific header name for some environments only.
 * And skips for others.
 *
 * @see https://www.drupal.org/project/reverse_proxy_header
 */
if (getenv("ENVIRONMENT_SPECIFIC_VARIABLE") === "value") {
  $settings["reverse_proxy_header"] = "HTTP_CF_CONNECTING_IP";
}

What about available alternatives?

  1. rename the header name (or copy its value) to the supported header HTTP_X_FORWARDED_FOR on proxy or server side;
  2. copy the value from the custom header to $_SERVER['HTTP_X_FORWARDED_FOR'] in your index.php before Drupal initialization;

πŸ‡ΊπŸ‡¦

This module is maintained by Ukrainian developers.
Please consider supporting Ukraine in a fight for their freedom and safety of Europe.

Activity

Total releases
3
First release
Jan 2025
Latest release
6 months ago
Release cadence
129 days
Stability
100% stable

Release Timeline

Releases

Version Type Release date
1.1.2 Stable Sep 24, 2025
1.1.1 Stable Jan 9, 2025
1.1.0 Stable Jan 9, 2025