When performing a web application security assessment that has the capability to detect and block attacks, the auditor has to figure out how to successfully complete the audit when these security elements block the client's IP address. Depending on how the application is configured and depending on the different perimetetral security elements that are part of the network architecture, the manipulation of the source IP address, through HTTP headers, can be enough to defeat the protection mechanisms. For example, a misconfigured application can make use of HTTP headers such as X-Forwarded-For to trigger actions against the client. Improper handling these IP addresses, sometimes manipulable by the user, can lead to the following: Bypass IP blocking when an attack occurs. ...