# Warning in console: The reverse proxy header configuration is incorrect. This is a security issue and can allow an attacker to spoof their IP address as visible to the Nextcloud

**URL:** <https://help.nextcloud.com/t/warning-in-console-the-reverse-proxy-header-configuration-is-incorrect-this-is-a-security-issue-and-can-allow-an-attacker-to-spoof-their-ip-address-as-visible-to-the-nextcloud/188602>\
**Category:** ℹ️ Support\
**Tags:** reverseproxy, nc28, php, php82, real-ip\
**Created:** [April 20, 2024, 12:52am UTC](https://help.nextcloud.com/t/warning-in-console-the-reverse-proxy-header-configuration-is-incorrect-this-is-a-security-issue-and-can-allow-an-attacker-to-spoof-their-ip-address-as-visible-to-the-nextcloud/188602 "2024-04-20T00:52:17Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![wwe](https://help.nextcloud.com/user_avatar/help.nextcloud.com/wwe/32/72963_2.png) [@wwe](https://help.nextcloud.com/u/wwe)\
**Post date:** [April 20, 2024, 8:32pm UTC](https://help.nextcloud.com/t/warning-in-console-the-reverse-proxy-header-configuration-is-incorrect-this-is-a-security-issue-and-can-allow-an-attacker-to-spoof-their-ip-address-as-visible-to-the-nextcloud/188602/2 "2024-04-20T20:32:35Z")

</div>

You can consult [Apache Docker behind reverse proxy](https://help.nextcloud.com/t/apache-docker-behind-reverse-proxy/151754) for hints how to adopt Apache to use real IP.

> [@4slam](#):
>
> They don’t keep a list of proxy IP addresses that I can specify in the `trusted_proxies` config parameter.

this is a problem as if you don’t limit the header to “known good” trusted proxies everybody could spoof the originating IPs. There is no need to know exact IPs you can use IP ranges like 192.168.0.0/24

If you don’t care about spoofing you can provide the whole IPv4 range (but I’m not going to share the syntax to avoid “copy&paste admins” from adopting this insecure approach).

---

_[View the full topic](https://help.nextcloud.com/t/warning-in-console-the-reverse-proxy-header-configuration-is-incorrect-this-is-a-security-issue-and-can-allow-an-attacker-to-spoof-their-ip-address-as-visible-to-the-nextcloud/188602)._