taken account of X-Forwarded-For header

[komuw]

everywhere we are using request.RemoteAddr[1]; we should first check if X-Forwarded-For[2] exists and use that instead. Then fall back to request.RemoteAddr.
See[3] for how golang/pkgsite does it. Also how they do ratelimiting is interesting[4]

1. https://github.com/komuw/ong/search?l=Go&q=RemoteAddr&type=
2. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For
3. https://github.com/golang/pkgsite/blob/8b9886cdffa22a4f43206ac784fa1646fd0b6da6/internal/middleware/quota.go#L89-L94
4. https://github.com/golang/pkgsite/blob/8b9886cdffa22a4f43206ac784fa1646fd0b6da6/internal/middleware/quota.go#L50-L70

[komuw]

There's also the Forwarded[1] header which is standardized and is supposed to be a replacement of X-Forwarded-For .
The good thing about it is that, your trusted front-end proxy could include a secret token[2] to identify itself.
Forwarded: for=12.34.56.78, for=23.45.67.89;secret=egah2CGj55fSJFs, for=10.1.2.3

1. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Forwarded
2. https://www.nginx.com/resources/wiki/start/topics/examples/forwarded/

[komuw]

We are not going to take X-Forwarded-For or Forwarded into account for now. This is because those headers can easily be spoofed among other problems. See[1] which deals with this comprehensively.

1. https://adam-p.ca/blog/2022/03/x-forwarded-for/

[komuw]

• X-Forwarded-For handling is unsafe gin-gonic/gin#2473
• https://nginx.org/en/docs/http/ngx_http_realip_module.html

[komuw]

Another algo for selecting IP: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For#selecting_an_ip_address

[komuw]

https://github.com/realclientip/realclientip-go written by the person who wrote https://adam-p.ca/blog/2022/03/x-forwarded-for/