Not sure if we should also handle X-Real-IP

Not sure if we should also handle X-Real-IP

Perhaps just make TrustForwardedIP a string setting, and if it's not None, it is the name of the header to use?

Tempted to borrow a page from mod_wsgi 4.4.9 and have it be a string, like you say, but possibly a list of headers. Granted, the headers have to be specifically supported, since the format of the value varies.

http://modwsgi.readthedocs.io/en/develop/release-notes/version-4.4.9.html

Please do note: the X-Forwarded-For header is defined as having the originating client as the FIRST entry. This means that you will want to use that instead of the last one.

https://tools.ietf.org/html/rfc7239#section-5.2

That's also in the page you linked to: "When X-Forwarded-For is used then the first IP address listed in the header value will be used."

Granted, if you trust your proxy, but maybe not other proxies, then the last ip is maybe the one you want to use for this sort of thing.

Well, for example in Fedora we override any previously set X-Forwarded-For at TLS termination, and include other proxies.

For example, in our setup I just had an: X-Forwarded-For: 80.127.148.xxx, ::1.
The ::1 is because we have another layer of proxies (haproxy).

So, the implementation that for example MediaWiki has gone with is to get the last entry that is not one of the "trusted proxies". So we have added "::1" as a trusted proxy, and then it'll correctly use 80.127.148.xxx as client IP.

After some discussions at DevConf, I think that the TrustForwardedIP option is of dubious benefit. I've removed it for now. If anyone really wants that, please file a separate issue/pr for it.

Rebased. Can I get a plus-one on the current version of this?

+1