Prevent X-Forwarded-For spoofing

Bah, I completely missed that. Yes it does work. Thanks so much. In the mean time I was mucking around with -nocase, but that is certainly a much more elegant solution.

However, is this not inefficient? It appears to remove the headers inserted by the HTTP profile too and not just outside headers. So perhaps an if exists, replace, else, insert and completely forgo the insert via the HTTP policy? Would this work? (or some permutation as I am by no means a TCL guy)

when HTTP_REQUEST {
foreach x [HTTP::header names] {
if { [string tolower $x] equals "x-forwarded-for" exists}
then
    if { [string tolower $x] equals "x-forwarded-for" } {
        HTTP::header remove $x
        HTTP::header replace X-FORWARDED-FOR [IP::client_addr]
    }
    else
    {HTTP::header insert X-FORWARDED-FOR [IP::client_addr]}
} 

}