Request Headers & Proxy Test
See the exact headers a server receives from your browser, curl or code, and whether a proxy or CDN added its own
Test from the command line
# What curl sends curl -s https://toolninja.io/api/echo-headers # Send your own header curl -s -H "X-Test: hello" https://toolninja.io/api/echo-headers # Through a proxy: compare "ip" and the proxy headers with the direct result curl -s -x http://proxy.example.com:8080 https://toolninja.io/api/echo-headers
Setting these headers correctly
# nginx: pass the real client on to your app, and only trust your own proxy
set_real_ip_from 10.0.0.0/8; # the address range of your proxy or load balancer
real_ip_header X-Forwarded-For;
real_ip_recursive on;
location / {
proxy_pass http://app:3000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}Requests are answered and forgotten: headers and IP addresses aren't stored. To see what a site sends back instead, use the HTTP Header Inspector.
Was the Request Headers & Proxy Test helpful?
About this tool
The Request Headers & Proxy Test shows what a server actually receives from you: every header, the IP address it sees, and notes on what each one means. It's useful when a header goes missing somewhere between your code and your server, or when you need to see what a browser, library or proxy really sends. You can add your own header to a test request, or call the endpoint with curl to compare clients. It separates headers that suggest a proxy or CDN handled the request, such as Via, CF-Connecting-IP or X-ProxyUser-Ip, from the rest. Be careful with the result in either direction: a proxy that adds nothing doesn't show up here, so finding no proxy headers doesn't prove there's no proxy. Comparing the IP address with what you expect tells you more. This site runs behind a hosting edge that sets X-Forwarded-For, X-Real-IP and similar headers itself and overwrites anything you send, so you can't spoof them here. That's the correct behavior, and your own server should only trust those headers from a proxy you control; the page includes an nginx example. Cookies and Authorization headers are noted but their values are never shown, and nothing is stored.
When to use it
- →Seeing exactly which headers your browser, curl or HTTP library sends
- →Debugging a custom header that doesn't reach your backend
- →Checking whether a corporate proxy or VPN adds identifying headers
- →Comparing your IP address with and without a proxy
Tips
- ◆Run the curl command directly and through your proxy with -x, then compare the IP and proxy headers.
- ◆Browsers won't let scripts set some headers, including Host and Cookie, so test those with curl.
- ◆User-Agent proves nothing about a client, because any client can set it to anything.
- ◆Header names are case-insensitive. HTTP/2 sends them in lowercase, so don't match them case-sensitively in code.
Frequently asked questions
How can I tell if I'm behind a proxy?
Headers like Via or X-ProxyUser-Ip are a clear sign. Their absence isn't proof of anything, since anonymous proxies and VPNs add nothing. The stronger test is comparing the IP address shown here with your connection's real address, or with the same test on a different network.
What is X-Forwarded-For?
A header proxies use to pass along the client's IP, as a comma-separated chain with each proxy adding the address it received from. Clients can send a fake one, so a server should only trust entries added by its own proxies.
Why doesn't my fake X-Forwarded-For show up?
This site's hosting edge sets that header itself and replaces whatever you send. An application that reads the header directly with no proxy in front would accept the fake, which is the mistake this header is known for.
Are my headers stored?
No. The response is built from the request and then forgotten. An anonymous counter limits how many requests one visitor can make in a short time. Cookie and Authorization values are left out of the response entirely.
ToolNinja