It's also a great example of assumptions leading to bugs. It's not a standard header, it's just a header... a string. IP addresses may easily be IPv6. You ca

It's also a great example of assumptions leading to bugs. It's not a standard header, it's just a header... a string. IP addresses may easily be IPv6. You can easily have comma delimited lists of them. You don't know how long the input will be. And unless you are sure that your network is cleaning the incoming requests and setting those headers, you shouldn't even begin to think that they are to be trusted for anything.