X-Forwarded-For header is not handled correctly

[haines]

🐛 Bug Report

The remote IP is appended to the X-Forwarded-For header, but the original value is not overwritten, leading to duplication.

If multiple X-Forwarded-For headers are present, the remote IP is appended to the first one, when it should be appended to the last one.

To Reproduce

1. Send a request to a gRPC-Gateway server with headers:

X-Forwarded-For: 1.2.3.4, 5.6.7.8
X-Forwarded-For: 9.10.11.12

Expected behavior

Either

• the remote IP is appended to the value of the last X-Forwarded-For header pair using ", " as a delimiter, and that pair is replaced; or
• an additional X-Forwarded-For pair is appended; or
• the existing X-Forwarded-For pairs are merged by joining their values with the delimiter ", " and the remote IP is appended.

so that the resulting metadata contains either

"X-Forwarded-For": []string{"1.2.3.4, 5.6.7.8", "9.10.11.12, ${remoteIP}"},

or

"X-Forwarded-For": []string{"1.2.3.4, 5.6.7.8", "9.10.11.12", "${remoteIP}"},

or

"X-Forwarded-For": []string{"1.2.3.4, 5.6.7.8, 9.10.11.12, ${remoteIP}"},

Per https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For#parsing

There may be multiple X-Forwarded-For headers present in a request. The IP addresses in these headers must be treated as a single list, starting with the first IP address of the first header and continuing to the last IP address of the last header. There are two ways of making this single list:

• join the X-Forwarded-For full header values with commas and then split by comma into a list, or
• split each X-Forwarded-For header by comma into lists and then join the lists

It is insufficient to use only one of multiple X-Forwarded-For headers.

(Some reverse proxies will automatically join multiple X-Forwarded-For headers into one, but it is safest to not assume that this is the case.)

Actual Behavior

With v2.19.1, the resulting metadata has X-Forwarded-For: []string{"1.2.3.4, 5.6.7.8", "1.2.3.4, 5.6.7.8, ${remoteIP}"}

[johanbrandhorst]

Thanks for your bug report! This seems like a clear bug. Would you be willing to help fix this?

[haines]

Yep, happy to, I'll submit a pull request tomorrow.