adds handling for x-forwarded-for comma-separated syntax (webtorrent#452)

Author: tdjsnelling

lib/server/parse-http.js

@@ -33,9 +33,17 @@ function parseHttpRequest (req, opts) {
       common.MAX_ANNOUNCE_PEERS
     )
 
-    params.ip = opts.trustProxy
-      ? req.headers['x-forwarded-for'] || req.connection.remoteAddress
-      : req.connection.remoteAddress.replace(common.REMOVE_IPV4_MAPPED_IPV6_RE, '') // force ipv4
+    if (opts.trustProxy) {
+      if (req.headers['x-forwarded-for']) {
+        const [realIp] = req.headers['x-forwarded-for'].split(',')
+        params.ip = realIp.trim()
+      } else {
+        params.ip = req.connection.remoteAddress
+      }
+    } else {
+      params.ip = req.connection.remoteAddress.replace(common.REMOVE_IPV4_MAPPED_IPV6_RE, '') // force ipv4
+    }
+
     params.addr = `${common.IPV6_RE.test(params.ip) ? `[${params.ip}]` : params.ip}:${params.port}`
 
     params.headers = req.headers

lib/server/parse-websocket.js

@@ -55,9 +55,17 @@ function parseWebSocketRequest (socket, opts, params) {
   // On first parse, save important data from `socket.upgradeReq` and delete it
   // to reduce memory usage.
   if (socket.upgradeReq) {
-    socket.ip = opts.trustProxy
-      ? socket.upgradeReq.headers['x-forwarded-for'] || socket.upgradeReq.connection.remoteAddress
-      : socket.upgradeReq.connection.remoteAddress.replace(common.REMOVE_IPV4_MAPPED_IPV6_RE, '') // force ipv4
+    if (opts.trustProxy) {
+      if (socket.upgradeReq.headers['x-forwarded-for']) {
+        const [realIp] = socket.upgradeReq.headers['x-forwarded-for'].split(',')
+        socket.ip = realIp.trim()
+      } else {
+        socket.ip = socket.upgradeReq.connection.remoteAddress
+      }
+    } else {
+      socket.ip = socket.upgradeReq.connection.remoteAddress.replace(common.REMOVE_IPV4_MAPPED_IPV6_RE, '') // force ipv4
+    }
+
     socket.port = socket.upgradeReq.connection.remotePort
     if (socket.port) {
       socket.addr = `${common.IPV6_RE.test(socket.ip) ? `[${socket.ip}]` : socket.ip}:${socket.port}`