AWS ELB Apache Get Client IP, Avoid X-Forwarded-For Spoofing
From apache docs (https://httpd.apace.org/docs/2.4/mod/mod_remoteip.html) we implemented the following assignment on our server: RemoteIPHeader X-Forwarded-For to get a client's IP rather than the ELB's IP. However, we didn't notice that the ELB also appends all other X-Forwarded-For values to the left…