To solve the append/prepend dilemma there's also X-Real-IP too. (At least the Nginx module does this.) So basically just log the x-f-f and use the other one as

To solve the append/prepend dilemma there's also X-Real-IP too. (At least the Nginx module does this.) So basically just log the x-f-f and use the other one as the real client IP. Of course, if you don't control the layers, then probably you should consider those headers invalid for an incoming request. (Though for email there's ARC to sign the added headers, maybe if someone really wants to provide at least marginally accountable HTTP proxies, they can use something like that.)