utils

func ClientIP ¶ added in v0.2.0

func ClientIP(req *http.Request, trustProxyHeaders bool) string

ClientIP returns the client IP for a request.

When trustProxyHeaders is false (default), only RemoteAddr is used. This is safe when Forq is exposed directly to clients.

When true, the rightmost entry of X-Forwarded-For is used (the IP the proxy adds for the connecting client), falling back to RemoteAddr if the header is absent or malformed. Set FORQ_TRUST_PROXY_HEADERS=true ONLY when Forq is behind a reverse proxy that strips or replaces incoming X-Forwarded-For from clients - otherwise attackers can spoof their IP and bypass throttling. Assumes a single proxy hop; multi-hop deployments should canonicalize the header at the edge proxy before it reaches Forq.