X-Forwarded-For header should be processed last-to-first to prevent IP spoofing

[santif]

Description

X-Forwarded-For header should be processed last-to-first to prevent IP spoofing, as explained in this post. It would be needed to set up IP addresses of known proxies to be ignored.

Current implementation

In context.go:

func (c *Context) ClientIP() string {
	if c.engine.ForwardedByClientIP {
		clientIP := c.requestHeader("X-Forwarded-For")
		clientIP = strings.TrimSpace(strings.Split(clientIP, ",")[0])
		if clientIP == "" {
			clientIP = strings.TrimSpace(c.requestHeader("X-Real-Ip"))
		}
		if clientIP != "" {
			return clientIP
		}
	}
	...