fix: correctly parse X-Forwarded-For when there are multiple IPs

bartjkdp · bartjkdp · commit 179ecffe12c2 · 2024-02-20T21:47:34.000+01:00
diff --git a/internal/utils/utils.go b/internal/utils/utils.go
@@ -85,12 +85,14 @@ func EnvSubst(input string) string {
 }
 
 func ReadUserIP(r *http.Request) string {
-	IPAddress := r.Header.Get("X-Forwarded-For")
-	if IPAddress == "" {
-		host, _, _ := net.SplitHostPort(r.RemoteAddr)
-		IPAddress = host
+	forwardedFor := r.Header.Get("X-Forwarded-For")
+	if forwardedFor != "" {
+		ips := strings.Split(forwardedFor, ",")
+		return strings.TrimSpace(ips[0])
 	}
-	return IPAddress
+
+	host, _, _ := net.SplitHostPort(r.RemoteAddr)
+	return host
 }
 
 func StringInSlice(a string, list []string) bool {

Original file line number	Diff line number	Diff line change
`@@ -85,12 +85,14 @@ func EnvSubst(input string) string {`
`85`	`85`	`}`
`86`	`86`
`87`	`87`	`func ReadUserIP(r *http.Request) string {`
`88`		`- IPAddress := r.Header.Get("X-Forwarded-For")`
`89`		`- if IPAddress == "" {`
`90`		`- host, _, _ := net.SplitHostPort(r.RemoteAddr)`
`91`		`- IPAddress = host`
	`88`	`+ forwardedFor := r.Header.Get("X-Forwarded-For")`
	`89`	`+ if forwardedFor != "" {`
	`90`	`+ ips := strings.Split(forwardedFor, ",")`
	`91`	`+ return strings.TrimSpace(ips[0])`
`92`	`92`	`}`
`93`		`- return IPAddress`
	`93`	`+`
	`94`	`+ host, _, _ := net.SplitHostPort(r.RemoteAddr)`
	`95`	`+ return host`
`94`	`96`	`}`
`95`	`97`
`96`	`98`	`func StringInSlice(a string, list []string) bool {`