code: @Nullable
    private String getRealRemoteAddressOrNull(HttpExchange httpExchange) {
      if (config.getTrustXForwardForHeader()) {
        List<String> forwardedIpsStr = httpExchange.getRequestHeaders().get("X-forwarded-for");
        if (forwardedIpsStr != null && forwardedIpsStr.size() > 0) {
          return forwardedIpsStr.get(0);
        }
      }
      return null;
    }
docs: A (reverse) proxy can set the 'X-forwarded-for' header so we can see a user's original IP.
  But that's just a common header than can also be set by the client. So we restrict access to this
  server to the load balancer, which should add the header originally with the user's own IP.