I think a security plugin author should have the awareness that X-Forwarded-For is just a string of untrusted user input. That definitely is the job of a secur

I think a security plugin author should have the awareness that X-Forwarded-For is just a string of untrusted user input. That definitely is the job of a security plugin author who uses the value. Whether it's lesson number one or number two... Don't trust your inputs has got to be near the top of things you learn when doing anything with security. Edit: now I've read the article... Shocked. The vast majority of this is trusting untrusted user input.