What security risks are associated with directly trusting values from superglobals like $_SERVER, and how should applications guard against header spoofing?

Certain values within $_SERVER, such as headers related to the client's claimed IP address behind a proxy, can be manipulated by a malicious client since they ultimately originate from data the client controls, meaning applications should never blindly trust these values for critical security decisions, such as access control, without properly configuring trusted proxy settings and validating that such headers are only accepted from genuinely trusted, known proxy servers.

// Only trust X-Forwarded-For header from known, configured trusted proxies
if (in_array($_SERVER['REMOTE_ADDR'], $trustedProxies)) {
    $realIp = $_SERVER['HTTP_X_FORWARDED_FOR'] ?? $_SERVER['REMOTE_ADDR'];
}