According to documentation, req.ips is
an array of IP addresses specified in the X-Forwarded-For request header.
My understanding is that this array should contain all IPs up to, but not including, the first trusted one. Although it is not explicit in the documentation, this excerpt endorses my speculation:
For example, if X-Forwarded-For is client, proxy1, proxy2, req.ips would be ["client", "proxy1", "proxy2"], where proxy2 is the furthest downstream.
The problem is that this expected behavior is not what actually happens. In the getter for req.ips, proxyaddr.all is used, which according to documentation returns
all the addresses of the request, optionally stopping at the first untrusted. This array is ordered from closest to furthest (i.e. arr[0] === req.connection.remoteAddress).
So, supposing app.set('trust proxy', 1), with the X-Forwarded-For header mentioned above, req.ips is ["proxy2"], going against the documentation.
According to documentation,
req.ipsisMy understanding is that this array should contain all IPs up to, but not including, the first trusted one. Although it is not explicit in the documentation, this excerpt endorses my speculation:
The problem is that this expected behavior is not what actually happens. In the getter for
req.ips,proxyaddr.allis used, which according to documentation returnsSo, supposing
app.set('trust proxy', 1), with theX-Forwarded-Forheader mentioned above,req.ipsis["proxy2"], going against the documentation.