Prevent X-Forwarded-For spoofing

I got that, I just don't know how to add the header to the rule. I tried

when HTTP_REQUEST {
foreach x [HTTP::header names] {
    if { [string tolower $x] equals "x-forwarded-for" } {
        HTTP::header remove $x
        HTTP::header replace X-FORWARDED-FOR [IP::client_addr]
    }
    else
      { HTTP::header insert X-FORWARDED-FOR [IP::client_addr]}
}   

}

But that tacked on seemingly a zillion headers

Try this:

when HTTP_REQUEST {
    set xff 0
    foreach x [HTTP::header names] {
        if { [string tolower $x] equals "x-forwarded-for" } {
            set xff 1
            HTTP::header remove $x
            HTTP::header insert X-FORWARDED-FOR [IP::client_addr]
        }
    }   
    if { $xff == 0 } {
        HTTP::header insert X-FORWARDED-FOR [IP::client_addr]
    }
}

Ah, brilliant. That works a peach. Thanks so much for your help on this one!

As far as I know, there's no harm in trying to remove missing headers so this rule can be pretty simple. This is a well-tested rule and should be used without any HTTP profile XFF options:

when HTTP_REQUEST {
  HTTP::header remove X-Forwarded-For    
  HTTP::header insert X-Forwarded-For [IP::remote_addr]
}

So if you want to deny XFF spoofing attack and see the client IP address at the same time, you have to disable XFF option on HTTP profile and then apply following irule will be enough ?

when HTTP_REQUEST { foreach x [HTTP::header names] { if { $x equals "X-FORWARDED-FOR" } { HTTP::header remove X-FORWARDED-FOR HTTP::header replace X-FORWARDED-FOR [IP::client_addr] } }

So if you want to deny XFF spoofing attack and see the client IP address at the same time, you have to disable XFF option on HTTP profile and then apply following irule will be enough ?

when HTTP_REQUEST {

foreach x [HTTP::header names] {
    if { $x equals "X-FORWARDED-FOR" } {
        HTTP::header remove X-FORWARDED-FOR
        HTTP::header replace X-FORWARDED-FOR [IP::client_addr]
    }
}   

}