What's the risk of trusting the X-Forwarded-For header for security decisions?

X-Forwarded-For is just a regular HTTP header that any client can set to an arbitrary value unless your infrastructure (reverse proxy/load balancer) is configured to strip any client-supplied value and set its own trusted value. Using it naively for IP-based rate limiting or geo-restriction can be trivially bypassed by an attacker simply spoofing the header, unless your edge infrastructure guarantees its integrity.