So we're supposed to be appending the client's IP to whatever the client sent for X-Forwarded-For, documented here: https://support.cloudflare.com/hc/en-us/art

So we're supposed to be appending the client's IP to whatever the client sent for X-Forwarded-For, documented here: https://support.cloudflare.com/hc/en-us/articles/200170986-How-does-Cloudflare-handle-HTTP-Request-headers- https://support.cloudflare.com/hc/en-us/articles/200170986-H... For better or worse, this is how X-Forwarded-For works, by convention: each forwarder is supposed to append a value. This means that, even in a correct implementation, an attacker can specify an arbitrary prefix of values. The consumer must be very careful about which part of the chain they trust. But the report here seems to be suggesting that we're mishandling this appending in some cases. We're investigating and if true will fix ASAP. Because X-Forwarded-For is surprisingly complicated, we recommend using CF-Connecting-IP instead. As the docs say: "To restore original visitor IP addresses at your origin web server, Cloudflare recommends your logs or applications look at CF-Connecting-IP or True-Client-IP instead of X-Forwarded-For since CF-Connecting-IP and True-Client-IP have a consistent format containing only one IP."