index.js
function forwarded(headers, whitelist) {
  var ports, port, proto, ips, ip, length = proxies.length, i = 0;

  for (; i < length; i++) {
    if (!(proxies[i].ip in headers)) continue;

    ports = (headers[proxies[i].port] || '').split(',');
    ips = (headers[proxies[i].ip] || '').match(pattern);
    proto = (headers[proxies[i].proto] || 'http');

    //
    // As these headers can potentially be set by a 1337H4X0R we need to ensure
    // that all supplied values are valid IP addresses. If we receive a none
    // IP value inside the IP header field we are going to assume that this
    // header has been compromised and should be ignored
    //
    if (!ips || !ips.every(net.isIP)) return;

    port = ports.shift();   // Extract the first port as it's the "source" port.
    ip = ips.shift();       // Extract the first IP as it's the "source" IP.

    //
    // If we were given a white list, we need to ensure that the proxies that
    // we're given are known and allowed.
    //
    if (whitelist && whitelist.length && !ips.every(function every(ip) {
      return ~whitelist.indexOf(ip);
    })) return;

    //
    // Shift the most recently found proxy header to the front of the proxies
    // array. This optimizes future calls, placing the most commonly found headers
    // near the front of the array.
    //
    if (i !== 0) {
      proxies.unshift(proxies.splice(i, 1)[0]);
    }

    //
    // We've gotten a match on a HTTP header, we need to parse it further as it
    // could consist of multiple hops. The pattern for multiple hops is:
    //
    //   client, proxy, proxy, proxy, etc.
    //
    // So extracting the first IP should be sufficient. There are SSL
    // terminators like the once's that is used by `fastly.com` which set their
    // HTTPS header to `1` as an indication that the connection was secure.
    // (This reduces bandwidth)
    //
    return new Forwarded(ip, port, proto === '1' || proto === 'https');
  }
}
function forwarded(headers, whitelist) {
  var ports, port, proto, ips, ip, length = proxies.length, i = 0;

  for (; i < length; i++) {
    if (!(proxies[i].ip in headers)) continue;

    ports = (headers[proxies[i].port] || '').split(',');
    ips = (headers[proxies[i].ip] || '').match(pattern);
    proto = (headers[proxies[i].proto] || 'http');

    //
    // As these headers can potentially be set by a 1337H4X0R we need to ensure
    // that all supplied values are valid IP addresses. If we receive a none
    // IP value inside the IP header field we are going to assume that this
    // header has been compromised and should be ignored
    //
    if (!ips || !ips.every(net.isIP)) return;

    port = ports.shift();   // Extract the first port as it's the "source" port.
    ip = ips.shift();       // Extract the first IP as it's the "source" IP.

    //
    // If we were given a white list, we need to ensure that the proxies that
    // we're given are known and allowed.
    //
    if (whitelist && whitelist.length && !ips.every(function every(ip) {
      return ~whitelist.indexOf(ip);
    })) return;

    //
    // Shift the most recently found proxy header to the front of the proxies
    // array. This optimizes future calls, placing the most commonly found headers
    // near the front of the array.
    //
    if (i !== 0) {
      proxies.unshift(proxies.splice(i, 1)[0]);
    }

    //
    // We've gotten a match on a HTTP header, we need to parse it further as it
    // could consist of multiple hops. The pattern for multiple hops is:
    //
    //   client, proxy, proxy, proxy, etc.
    //
    // So extracting the first IP should be sufficient. There are SSL
    // terminators like the once's that is used by `fastly.com` which set their
    // HTTPS header to `1` as an indication that the connection was secure.
    // (This reduces bandwidth)
    //
    return new Forwarded(ip, port, proto === '1' || proto === 'https');
  }
}
function forwarded ( headers , whitelist ) { var ports , port , proto , ips , ip , length = proxies . length , i = 0 ; for ( ; i < length ; i ++ ) { if ( ! ( proxies [ i ] . ip in headers ) ) continue ; ports = ( headers [ proxies [ i ] . port ] || '' ) . split ( ',' ) ; ips = ( headers [ proxies [ i ] . ip ] || '' ) . match ( pattern ) ; proto = ( headers [ proxies [ i ] . proto ] || 'http' ) ; // // As these headers can potentially be set by a 1337H4X0R we need to ensure // that all supplied values are valid IP addresses. If we receive a none // IP value inside the IP header field we are going to assume that this // header has been compromised and should be ignored // if ( ! ips || ! ips . every ( net . isIP ) ) return ; port = ports . shift ( ) ; // Extract the first port as it's the "source" port. ip = ips . shift ( ) ; // Extract the first IP as it's the "source" IP. // // If we were given a white list, we need to ensure that the proxies that // we're given are known and allowed. // if ( whitelist && whitelist . length && ! ips . every ( function every ( ip ) { return ~ whitelist . indexOf ( ip ) ; } ) ) return ; // // Shift the most recently found proxy header to the front of the proxies // array. This optimizes future calls, placing the most commonly found headers // near the front of the array. // if ( i !== 0 ) { proxies . unshift ( proxies . splice ( i , 1 ) [ 0 ] ) ; } // // We've gotten a match on a HTTP header, we need to parse it further as it // could consist of multiple hops. The pattern for multiple hops is: // //   client, proxy, proxy, proxy, etc. // // So extracting the first IP should be sufficient. There are SSL // terminators like the once's that is used by `fastly.com` which set their // HTTPS header to `1` as an indication that the connection was secure. // (This reduces bandwidth) // return new Forwarded ( ip , port , proto === '1' || proto === 'https' ) ; } }
Search the headers for a possible match against a known proxy header.

@param {Object} headers The received HTTP headers.
@param {Array} whitelist White list of proxies that should be checked.
@returns {Forwarded|Undefined} A Forwarded address object or nothing.
@api private
Search the headers for a possible match against a known proxy header .