feat: improve IP parsing from X-Forwarded-For header

[0xERR0R]

closes #1938

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.20%. Comparing base (605a361) to head (131629e).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1940      +/-   ##
==========================================
+ Coverage   90.19%   90.20%   +0.01%     
==========================================
  Files          90       90              
  Lines        6434     6445      +11     
==========================================
+ Hits         5803     5814      +11     
  Misses        492      492              
  Partials      139      139              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull Request Overview

This PR enhances the HTTPClientIP function to properly parse comma-separated IP addresses from the X-Forwarded-For header, enabling accurate client IP extraction when the service is behind multiple proxies. The implementation adds robust handling for whitespace, multiple proxy chains, IPv6 addresses, and graceful fallback to RemoteAddr when the header is invalid or missing.

• Improved X-Forwarded-For header parsing to extract the leftmost (original client) IP from comma-separated proxy chains
• Added comprehensive test coverage for multiple edge cases including IPv6, whitespace handling, and invalid inputs
• Introduced a helper function to split and trim comma-separated values

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
util/http.go	Added splitCommaSeparated helper function and enhanced HTTPClientIP to parse comma-separated X-Forwarded-For headers with proper whitespace handling and fallback logic
util/http_test.go	Added 6 new test cases covering comma-separated IPs, extra whitespace, IPv6 addresses, invalid inputs, empty strings, and whitespace-only scenarios

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.