En esta página, se describen algunas prácticas recomendadas para trabajar con Advanced API Security.
Preserva los encabezados de la solicitud X-Forwarded-For
El encabezado de la solicitud X-Forwarded-For (XFF) es un encabezado estándar que se usa para identificar las direcciones IP de origen de los clientes que se conectan a un servidor web a través de un servidor proxy. Muchas plataformas proporcionan la capacidad de quitar los encabezados XFF de las solicitudes entrantes por motivos de seguridad. Sin embargo, esto no se recomienda si usas la seguridad avanzada de la API, ya que los algoritmos de aprendizaje automático que usa necesitan la información de la dirección IP para identificar el tráfico de abuso y calcular las puntuaciones de seguridad.
Cómo determinar si tu plataforma quita los encabezados XFF
Para determinar si tu plataforma quita los encabezados XFF, realiza una llamada a la API como la siguiente:
[[["Fácil de comprender","easyToUnderstand","thumb-up"],["Resolvió mi problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Información o código de muestra incorrectos","incorrectInformationOrSampleCode","thumb-down"],["Faltan la información o los ejemplos que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-09-04 (UTC)"],[[["\u003cp\u003eThis guide covers best practices for utilizing Advanced API Security in both Apigee and Apigee hybrid environments.\u003c/p\u003e\n"],["\u003cp\u003eCustomizing client IP resolution is available per environment, allowing Advanced API Security to accurately identify and utilize the client IP address for each API request.\u003c/p\u003e\n"],["\u003cp\u003ePreserving X-Forwarded-For (XFF) headers is crucial for Advanced API Security, as the IP address data is needed to identify abuse traffic and calculate security scores.\u003c/p\u003e\n"],["\u003cp\u003eStripped XFF headers can be identified by making an API call, which will return "(not set)" if the headers are being removed.\u003c/p\u003e\n"]]],[],null,["# Advanced API Security best practices\n\n*This page\napplies to **Apigee** and **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\nThis page describes some best practices for working with Advanced API Security.\n\nConfigure client IP resolution\n------------------------------\n\nIf the\n[default client IP resolution algorithm](/apigee/docs/api-platform/system-administration/client-ip-resolution#default-client-ip-address-resolution)\ndoes not work for your use case, it can be customized per environment. See\n[client IP resolution](/apigee/docs/api-platform/system-administration/client-ip-resolution).\nConfiguring this setting allows\nAdvanced API Security to find and use the appropriate client IP address for each API request, and ensures\nconsistent client IP address resolution across your environment.\n\nIn order to use client IP resolution, you'll also need to\n[Preserve X-Forwarded-For request headers](#preserve-x-forwarded-for-request-headers).\n\nPreserve X-Forwarded-For request headers\n----------------------------------------\n\nThe X-Forwarded-For (XFF) request header is a standard header for identifying the originating\nIP addresses of clients connecting to a web server through a proxy server. Many platforms\nprovide the ability to strip off XFF headers from incoming requests for security\npurposes. However,\nthis is not recommended if you are using Advanced API Security, because the machine learning\nalgorithms it uses need the IP address information to identify abuse traffic, and to\ncalculate security scores.\n\n### How to determine if your platform is stripping off XFF headers\n\nTo determine if your platform is stripping off XFF headers, make an\nAPI call like the following: \n\n```\ncurl https://apigee.googleapis.com/v1/organizations/ORG/environments/ENV/stats/x_forwarded_for_ip?select=avg\\(total_response_time\\)&timeRange=9/24/2018%2000:00~10/25/2018%2000:00&timeUnit=day \\\n -H \"Authorization: Bearer $TOKEN\"\n```\n\nwhere \u003cvar translate=\"no\"\u003eORG\u003c/var\u003e is your organization and \u003cvar translate=\"no\"\u003eENV\u003c/var\u003e is an environment in the\norganization.\n\nIf your platform is stripping off XFF headers, this returns a response in which the first line will be \n\n```\n \"name\": \"(not set)\",\n```\n\nThe `(not set)` in the response means your platform is\nstripping off XFF headers."]]
