Logged IPs from custom domain are just 127.0.0.1

[wh0]

I heard about an “X-Forwarded-For” header the last time this came up:

Any way to reliably get an incoming request's real IP address for rate-limiting? (I.e. prevent `x-forwarded-for` spoofing?)

Hey @joe - sorry I missed that context from your original question. You’re correct that if someone provides the X-Forwarded-For header in their request, the contents of that header is appended to the list of IPs already present. Unfortunately Glitch doesn’t provide any better information than what’s in that header - sorry for the inconvenience! One thing that might help is that providing a custom X-Forwarded-For value doesn’t remove the actual upstream IP address from the list, it just adds tha…

They were talking about some fiddliness about how to figure out which headers came from the client (i.e. not trustworthy) and which came from Glitch’s middleware, so you’ll probably have to figure that out too.