fds

src/inc/security.mjs

@@ -26,14 +26,17 @@ export default new class {
      * @returns {string}
      */
     getRealIP(req) {
-        let ip = req.headers['cf-connecting-ip'] ||
+        let rawIp = req.headers['cf-connecting-ip'] ||
             req.headers['true-client-ip'] ||
             req.headers['x-client-ip'] ||
             req.headers['x-real-ip'] ||
-            (req.headers['x-forwarded-for'] ? req.headers['x-forwarded-for'].split(',')[0].trim() : null) ||
-            req.socket.remoteAddress;
+            req.headers['x-forwarded-for'] ||
+            req.socket?.remoteAddress;
 
-        if (!ip) return "unknown";
+        if (!rawIp) return "unknown";
+
+        // If the header contains a comma-separated proxy chain (e.g. "IP1, IP2"), extract the client IP (first element)
+        let ip = String(rawIp).split(',')[0].trim();
 
         // Handle IPv6 loopback and mapped IPv4
         if (ip === "::1") ip = "127.0.0.1";