X-Forwarded-For header should be processed last-to-first to prevent IP spoofing #2232
Description
Description
X-Forwarded-For header should be processed last-to-first to prevent IP spoofing, as explained in this post. It would be needed to set up IP addresses of known proxies to be ignored.
Current implementation
In context.go:
func (c *Context) ClientIP() string {
if c.engine.ForwardedByClientIP {
clientIP := c.requestHeader("X-Forwarded-For")
clientIP = strings.TrimSpace(strings.Split(clientIP, ",")[0])
if clientIP == "" {
clientIP = strings.TrimSpace(c.requestHeader("X-Real-Ip"))
}
if clientIP != "" {
return clientIP
}
}
...