IP spoofing is the practice of forging the source address in network packets so that traffic appears to come from a different, often trusted, system. Attackers use it to hide where traffic really comes from or to impersonate an address that a system trusts. It is most commonly associated with connectionless traffic, and with denial-of-service attacks where the attacker does not need to receive replies.
Spoofing is much harder to use for a full web request. A normal HTTPS connection requires a back-and-forth handshake, and the replies go to the address that was claimed, so an attacker who forges the source address generally cannot complete the exchange. For that reason, spoofing the network source address is usually not a practical way to carry out an ordinary web attack, although it remains relevant to other kinds of traffic.
Spoofing the network address is different from forging an HTTP header such as one that states the client address. Headers are simply text the client sends, and an application or rule that trusts them without checking can be misled. Whether a header can be trusted depends on which system set it and whether anything upstream overwrites it.
When designing protections, do not rely on source addresses alone to prove identity. Prefer stronger checks such as certificates or authentication, apply filtering at the network edge where possible, and make sure applications take client address information only from components you control.