Use last IP address from X-Forwarded-For without validation of trusty

1 files changed, 8 insertions, 3 deletions

diff --git a/service/http/handler.go b/service/http/handler.go
index 254f5ca6..19179b72 100644
--- a/service/http/handler.go
+++ b/service/http/handler.go
@@ -152,12 +152,17 @@ func (h *Handler) resolveIP(r *Request) {
 	}
 
 	if r.Header.Get("X-Forwarded-For") != "" {
-		for _, addr := range strings.Split(r.Header.Get("X-Forwarded-For"), ",") {
-			addr = strings.TrimSpace(addr)
-			if h.cfg.IsTrusted(addr) {
+		ips := strings.Split(r.Header.Get("X-Forwarded-For"), ",")
+		ipCount := len(ips)
+
+		for i := ipCount - 1; i >= 0; i-- {
+			addr := strings.TrimSpace(ips[i])
+			if h.cfg.IsValid(addr) {
 				r.RemoteAddr = addr
+				return
 			}
 		}
+
 		return
 	}