# Proxy header leakage

Proxy header leakage is the disclosure of proxy use, or of the client's real address, through HTTP headers such as X-Forwarded-For, Via, Forwarded or X-Real-IP that some proxies add to forwarded requests. It only affects plain HTTP, since a proxy cannot alter the encrypted content of an HTTPS request, and it is the defining difference between transparent, anonymous and elite proxies.


## Checklist

1. Fetch a header-echo endpoint over plain HTTP through the proxy and read every header.
2. Any `X-Forwarded-For`, `Via`, `Forwarded` or `X-Real-IP` is a leak; the request should carry only what your client sent.
3. Also check what your own client adds: some libraries set revealing user agents or `Proxy-Connection` headers.


## Headers your client should not send

`Proxy-Connection`, stale `Proxy-Authorization` values and library-default user agents identify automation as surely as a proxy header does. Set headers deliberately and consistently with the browser you imitate.


## How it works at ProxShift

ProxShift gateways remove proxy-related headers arriving from the client and add none toward the destination; the request reaches the target exactly as an elite proxy should deliver it.

Source: https://proxshift.com/glossary/header-leakage