code: function getRemoteIp(req) {
    const forwardedForHeader = req.headers['x-forwarded-for'];
  
    if (!forwardedForHeader) {
      if (macros.PROD) {
        macros.error('No forwardedForHeader?', req.headers, req.connection.remoteAddress);
      }
  
      return req.connection.remoteAddress;
    }
  
    const splitHeader = forwardedForHeader.split(',');
  
    // Cloudflare sometimes sends health check requests
    // which will only have 1 item in this header
    if (splitHeader.length === 1) {
      macros.error('Only have one item in the header?', forwardedForHeader);
      return splitHeader[0].trim();
    }
  
  
    if (splitHeader.length > 2) {
      macros.log('Is someone sending a forged header?', forwardedForHeader);
    }
  
    return splitHeader[splitHeader.length - 2].trim();
  }
docs: This is more complicated than just req.connection.remoteAddress (which will always be 127.0.0.1) because this Node.js server is running behind both nginx and Cloudflare. This will return the IP of the user connecting to the site Because there are two step between us and the user, we need to check the second the last item in the x-forwarded-for header. We shouldn't check the first item in the header, because someone could send a forged x-forwarded-for header that would be added to the beginning of the x-forwarded-for that is received here.