title: Get client's real IP address on Heroku
body: <p>On any Heroku stack, I want to get the client's IP. my first attempt might be:</p>
  <pre><code>request.headers['REMOTE_ADDR']
  </code></pre>
  <p>This does not work, of course, because all requests are passed through proxies. So the alternative was to use:</p>
  <pre><code>request.headers['X-Forwarded-For']
  </code></pre>
  <p>But this is not quite safe, is it?</p>
  <p>If it contains only one value, I take this. If it contains more than one value (comma-separated), I could take the first one.</p>
  <p>But what if someone manipulates this value? I cannot trust <code>request.headers['X-Forwarded-For']</code> as I could with <code>request.headers['REMOTE_ADDR']</code>. And there is no list of trusted proxies that I could use, either.</p>
  <p>But there must be <em>some way</em> to reliably get the client's IP address, always. Do you know one?</p>
  <p>In <a href="https://devcenter.heroku.com/articles/http-routing#heroku-headers" rel="nofollow noreferrer">their docs</a>, Heroku describes that <code>X-Forwarded-For</code> is &quot;the originating IP address of the client connecting to the Heroku router&quot;.</p>
  <p>This sounds as if Heroku could be overwriting the <code>X-Forwarded-For</code> with the originating remote IP. This would prevent spoofing, right? Can someone verify this?</p>