... a load balancer (Nginx, HAProxy, Envoy, ELB/ALB, etc), HTTP cache (CloudFlare, Squid, Varnish, etc), or other intermediary (reverse) proxy. Laravel (technically the Symfony HTTP base classes) have a concept of a "trusted proxy", where those X-Forwarded headers will only be used if the source IP address of the request is known. In other words, it only trusts those headers if the proxy is trusted.