title: Can I trust X-Forwarded-For header value when whitelisting IP address?
body: <p>I'm trying to add IP whitelisting feature on a gateway.
  (I'm using Spring cloud gateway but I think the framework is not important when it comes to implementing this feature)</p>
  <p>Most of the implementation use <code>X-Forwarded-For</code>
  HTTP header value to verify the client IP address. <strong>But I'm curious this is a secure way because someone in the middle (such as a proxy) could be tampering with this value so I think we should not trust this value</strong>. Or is there another way to implementing it?
  Thank you.</p>