Policy/display-capture)
    9. [ Permissions-Policy: document-domain ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/document-domain) Experimental 
    10. [ Permissions-Policy: encrypted-media ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/encrypted-media) Experimental 
    11. [ Permissions-Policy: execution-while-not-rendered ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/execution-while-not-rendered) Experimental 
    12. [ Permissions-Policy: execution-while-out-of-viewport ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/execution-while-out-of-viewport) Experimental 
    13. [ Permissions-Policy: fullscreen ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/fullscreen)
    14. [ Permissions-Policy: gamepad ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/gamepad) Experimental 
    15. [ Permissions-Policy: geolocation ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/geolocation)
    16. [ Permissions-Policy: gyroscope ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/gyroscope) Experimental 
    17. [ Permissions-Policy: hid ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/hid) Experimental 
    18. [ Permissions-Policy: identity-credentials-get ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/identity-credentials-get) Experimental 
    19. [ Permissions-Policy: idle-detection ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/idle-detection) Experimental 
    20. [ Permissions-Policy: local-fonts ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/local-fonts) Experimental 
    21. [ Permissions-Policy: magnetometer ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/magnetometer) Experimental 
    22. [ Permissions-Policy: microphone ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/microphone)
    23. [ Permissions-Policy: midi ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/midi) Experimental 
    24. [ Permissions-Policy: otp-credentials ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/otp-credentials) Experimental 
    25. [ Permissions-Policy: payment ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/payment) Experimental 
    26. [ Permissions-Policy: picture-in-picture ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/picture-in-picture) Experimental 
    27. [ Permissions-Policy: publickey-credentials-create ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/publickey-credentials-create) Experimental 
    28. [ Permissions-Policy: publickey-credentials-get ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/publickey-credentials-get)
    29. [ Permissions-Policy: screen-wake-lock ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/screen-wake-lock)
    30. [ Permissions-Policy: serial ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/serial) Experimental 
    31. [ Permissions-Policy: speaker-selection ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/speaker-selection) Experimental 
    32. [ Permissions-Policy: storage-access ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/storage-access) Experimental 
    33. [ Permissions-Policy: usb ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/usb) Experimental 
    34. [ Permissions-Policy: web-share ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/web-share)
    35. [ Permissions-Policy: window-management ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/window-management) Experimental 
    36. [ Permissions-Policy: xr-spatial-tracking ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/xr-spatial-tracking) Experimental 

##  In this article

  * Security and privacy concerns 
  * Syntax 
  * Directives 
  * Examples 
  * Parsing 
  * Selecting an IP address 
  * Specifications 
  * See also 

#  X-Forwarded-For

The **` X-Forwarded-For ` ** (XFF) request header is a de-facto standard
header for identifying the originating IP address of a client connecting to a
web server through a proxy server.

**Warning:** Improper use of this header can be a security risk. For details,
see the  Security and privacy concerns  section.

When a client connects directly to a s