a

internal/auth/session.go

@@ -5,7 +5,9 @@ import (
 	"context"
 	"database/sql"
 	"fmt"
+	"net"
 	"net/http"
+	"strings"
 	"time"
 
 	"ghb.freebede.com/nahakubuilder/mailgosend/internal/crypto"
@@ -245,11 +247,18 @@ func scanUser(row *sql.Row) (*models.User, error) {
 // ---- Helpers ----
 
 func realIP(r *http.Request) string {
-	if ip := r.Header.Get("X-Real-IP"); ip != "" {
-		return ip
+	if xri := r.Header.Get("X-Real-IP"); xri != "" {
+		if parsed := net.ParseIP(strings.TrimSpace(xri)); parsed != nil {
+			return parsed.String()
+		}
 	}
-	if ip := r.Header.Get("X-Forwarded-For"); ip != "" {
-		return ip
+	if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
+		for _, part := range strings.Split(xff, ",") {
+			trimmed := strings.TrimSpace(part)
+			if parsed := net.ParseIP(trimmed); parsed != nil {
+				return parsed.String()
+			}
+		}
 	}
 	host, _, err := parseHostPort(r.RemoteAddr)
 	if err != nil {