概念概述
PROXY 协议保留客户端地址（PROXY Protocol for Client Address Preservation）指的是：PROXY 协议在连接数据前附加原始客户端地址，使负载均衡器后的后端能看到真实来源 IP 与端口，而不是代理自身的地址。
从更严格的定义看，PROXY protocol is a lightweight line of metadata that a trusted proxy sends before the real payload, conveying the original connection’s source and destination addresses so the next hop can log and authorise against the true client. 该概念在工程实践中的价值，在于它能帮助团队用统一的语言描述一个具体的质量属性或设计约束，从而在评审与协作中减少歧义。
为什么需要它
It appears whenever a TLS terminator or layer 4 load balancer must forward connections without rewriting the payload itself, which rules out headers such as X-Forwarded-For. 它与 Server-Timing Metrics Header、Hop-by-Hop Versus End-to-End Headers、HTTP Trailer Fields 等概念经常一起出现，用于解决相近的工程问题。理解它的适用场景，有助于在多种备选方案之间做出有依据的取舍，而不是凭直觉选择技术方案。
常见误解
- any client may send PROXY protocol safely because the server validates it
- the header replaces the need to trust the immediate peer
需要避免的反模式
- enabling PROXY protocol on ports that are reachable from the public internet
- mixing PROXY-enabled and plain backend ports on the same listener
实践要点
- The v1 form is a single ASCII line beginning with PROXY and v2 is a binary fixed header, but both rely entirely on the receiver trusting that only the proxy can connect.
- Because the address is claimed rather than proven, an exposed listener that accepts PROXY headers lets any client forge its source address and defeat IP allowlists or rate limits.
- Parse the header strictly, reject it on untrusted interfaces, and keep a separate port or network policy for health checks that arrive without the prefix.