Use of Less Trusted Source

Overview Affected versions of this package are vulnerable to Use of Less Trusted Source via the ExtractIPFromRealIPHeader function in ip.go. With the extractor’s default trust options, an attacker can make c.RealIP return a forged loopback or private address by sending an X-Real-IP header, causin...