realip module using first of multiple X-Real-IP or custom headers

[Andjelko Horvat]

This is continuation of ​https://trac.nginx.org/nginx/ticket/106 ngx_http_realip_module issue with multiple headers.

When multiple X-Real-IP or custom header set with real_ip_header is sent in the request, nginx uses the first header but it should use the last one.

E.g. in request like:

curl -vIL -H'X-Real-IP: 1.1.1.1' -H'X-Real-IP: 2.2.2.2' 127.0.0.1 2>&1 | grep '^>'
> HEAD / HTTP/1.1
> User-Agent: curl/7.38.0
> Host: 127.0.0.1
> Accept: */*
> X-Real-IP: 1.1.1.1
> X-Real-IP: 2.2.2.2

1.1.1.1 would be used and not 2.2.2.2. If the load balancer just appends new X-Real-IP header at the end, then still the first header is used, and the client can e.g. bypass nginx ACLs.

This was fixed in #106 for X-Forwarded-For header in a way that multiple headers are merged in one, but in X-Real-IP/custom header case only the last header could be used without merging.

[Maxim Dounin]

The X-Real-IP header is not expected to be used more than once (and it is expected to contain only one address). Accordingly, any additional X-Real-IP header fields are ignored by nginx. Load balancers are expected to replace the header, not append or even prepend it (though prepend will work correctly).