A trusted proxy is a reverse proxy that a backend application is configured to believe. It may add or forward identity data such as the client IP, username, or original host through headers like X-Forwarded-For or X-Forwarded-User. The application treats that information as authoritative only because the proxy is on an allowlist.
This matters because proxy trust is a security boundary, not a convenience feature. If an application trusts the wrong proxy, or accepts those headers from an untrusted source, an attacker can forge identity data and bypass access controls, logging, or authentication checks. In systems such as admin consoles and webserver-based deployments, misconfigured trusted-proxy logic can make a request appear to come from a legitimate user when it does not. Defenders should tightly restrict which proxies are trusted, strip spoofed headers at the edge, and verify that the backend only consumes identity data from approved infrastructure.