Method extractIPFromHeader

req.go:636–693

extractIPFromHeader returns the client IP from the given proxy header by walking the X-Forwarded-For chain from right to left and stripping trusted proxy IPs. When trusted proxies are configured, the rightmost non-trusted IP is returned; otherwise the first valid IP (left-to-right) is returned. When

(header string)

// valid IP (left-to-right) is returned. When IP validation is disabled, the raw header
// value is returned as-is.
func (r *DefaultReq) extractIPFromHeader(header string) string {
	app := r.c.app

	if !app.config.EnableIPValidation {
		return r.Get(header)
	}

	headerValue := r.Get(header)
	hasTrustedProxyConfig := r.hasTrustedProxyConfig()
	if !hasTrustedProxyConfig {
		start := 0
		for {
			end := start
			for end < len(headerValue) && headerValue[end] != ',' {
				end++
			}

			ipStr := utils.Trim(headerValue[start:end], ' ')
			if isValidProxyIP(ipStr) {
				return ipStr
			}
			if end == len(headerValue) {
				break
			}
			start = end + 1
		}
	}

	var leftmostIP string

	for end := len(headerValue); end > 0; {
		start := end
		for start > 0 && headerValue[start-1] != ',' {
			start--
		}

		ipStr := utils.Trim(headerValue[start:end], ' ')
		if isValidProxyIP(ipStr) {
			leftmostIP = ipStr
			if !r.isTrustedProxyIP(ipStr) {
				return ipStr
			}
		}

		if start == 0 {
			break
		}
		end = start - 1
	}

	if leftmostIP != "" {
		return leftmostIP
	}
	if ip := r.c.fasthttp.RemoteIP(); ip != nil {
		return ip.String()
	}
	return ""
}