fix: add triming operation before returning client IP (#300)

craigzour · web-flow · commit 131699481f83 · 2026-02-16T14:47:24.000Z
diff --git a/src/middleware/extractClientIp.ts b/src/middleware/extractClientIp.ts
@@ -41,5 +41,7 @@ function extractClientIpFromRequestHeaders(
    * Only consider last IP as the source of truth as it has been added by AWS ECS Load balancer
    * See https://docs.aws.amazon.com/elasticloadbalancing/latest/application/x-forwarded-headers.html#x-forwarded-for-append
    */
-  return xForwardedForHeader.split(",").at(-1) ?? FALLBACK_CLIENT_IP_ADDRESS;
+  return (
+    xForwardedForHeader.split(",").at(-1)?.trim() ?? FALLBACK_CLIENT_IP_ADDRESS
+  );
 }

Original file line number	Diff line number	Diff line change
`@@ -41,5 +41,7 @@ function extractClientIpFromRequestHeaders(`
`41`	`41`	`* Only consider last IP as the source of truth as it has been added by AWS ECS Load balancer`
`42`	`42`	`* See https://docs.aws.amazon.com/elasticloadbalancing/latest/application/x-forwarded-headers.html#x-forwarded-for-append`
`43`	`43`	`*/`
`44`		`- return xForwardedForHeader.split(",").at(-1) ?? FALLBACK_CLIENT_IP_ADDRESS;`
	`44`	`+ return (`
	`45`	`+ xForwardedForHeader.split(",").at(-1)?.trim() ?? FALLBACK_CLIENT_IP_ADDRESS`
	`46`	`+ );`
`45`	`47`	`}`