Is the x-forwarded-for header in the req object trustworthy?

[winkcor]

In Advanced initialization and authorize function in providers, the req object contains the x-forwarded-for header, which I can use to get the user's IP. I want to confirm if this header is set by NextAuth and whether it's trustworthy — ensuring users can't modify it.

And is it set by trusting other proxies? I don't trust any proxy in my app, so if yes, how can I get IP of sender?
Is it possible to determine trusted proxy addresses?

I noticed the docs don’t mention this explicitly.