code: func SourceIPs(req *http.Request) []net.IP {
  	hdr := req.Header
  	// First check the X-Forwarded-For header for requests via proxy.
  	hdrForwardedFor := hdr.Get("X-Forwarded-For")
  	forwardedForIPs := []net.IP{}
  	if hdrForwardedFor != "" {
  		// X-Forwarded-For can be a csv of IPs in case of multiple proxies.
  		// Use the first valid one.
  		parts := strings.Split(hdrForwardedFor, ",")
  		for _, part := range parts {
  			ip := net.ParseIP(strings.TrimSpace(part))
  			if ip != nil {
  				forwardedForIPs = append(forwardedForIPs, ip)
  			}
  		}
  	}
  	if len(forwardedForIPs) > 0 {
  		return forwardedForIPs
  	}
  
  	// Try the X-Real-Ip header.
  	hdrRealIp := hdr.Get("X-Real-Ip")
  	if hdrRealIp != "" {
  		ip := net.ParseIP(hdrRealIp)
  		if ip != nil {
  			return []net.IP{ip}
  		}
  	}
  
  	// Fallback to Remote Address in request, which will give the correct client IP when there is no proxy.
  	// Remote Address in Go's HTTP server is in the form host:port so we need to split that first.
  	host, _, err := net.SplitHostPort(req.RemoteAddr)
  	if err == nil {
  		if remoteIP := net.ParseIP(host); remoteIP != nil {
  			return []net.IP{remoteIP}
  		}
  	}
  
  	// Fallback if Remote Address was just IP.
  	if remoteIP := net.ParseIP(req.RemoteAddr); remoteIP != nil {
  		return []net.IP{remoteIP}
  	}
  
  	return nil
  }
docs: // SourceIPs splits the comma separated X-Forwarded-For header or returns the X-Real-Ip header or req.RemoteAddr,
  // in that order, ignoring invalid IPs. It returns nil if all of these are empty or invalid.