An ecommerce application is running behind an Application Load Balancer. A developer observes some unexpected load on the application during non-peak hours. The developer wants to analyze patterns for the client IP addresses that use the application. Which HTTP header should the developer use for this analysis?

When an Application Load Balancer (ALB) receives a request from a client, it terminates the connection and initiates a new one to the backend target. To provide the backend application with information about the original request, the ALB adds several HTTP headers. The X-Forwarded-For (XFF) request header is specifically used to identify the originating IP address of the client connecting to the load balancer. Analyzing this header allows the developer to identify and track client IP addresses to understand traffic patterns.

A. The X-Forwarded-Proto header identifies the protocol (HTTP or HTTPS) used by the client to connect to the load balancer, not the client's IP address.
B. The X-Forwarded-Host header is not a standard header added by an Application Load Balancer. The original Host header from the client is passed to the target.
D. The X-Forwarded-Port header identifies the destination port of the request that the client used to connect to the load balancer, not the client's IP address.

1. AWS Documentation: Elastic Load Balancing User Guide for Application Load Balancers.

Reference: "HTTP headers and Application Load Balancers" section.

Details: This document explicitly states

"The X-Forwarded-For request header helps you identify the IP address of a client when you use an HTTP or HTTPS load balancer." It also details the purpose of X-Forwarded-Proto and X-Forwarded-Port

confirming they do not contain the client IP address.

2. AWS Documentation: Elastic Load Balancing User Guide for Application Load Balancers.

Reference: "Request routing" section

under "Target groups for your Application Load Balancers".

Details: The documentation describes how the load balancer routes requests to registered targets. It implicitly relies on the fact that the load balancer acts as a proxy

which necessitates headers like X-Forwarded-For to preserve original client information for backend processing and logging.