phpCAS is not handling logout requests when behind a load balancer

1. place your app behind a load balancer.
2. configure config.php
   $cas_real_hosts = array('cas-real-1.example.com', 'cas-real-2.example.com');
3. login to your app
4. in a separate browser tab visit: https://your.cas-server.com/cas/logout
5. go back to your app and refresh the page
6. The app is still logged in... should not be

I suspect this is due to Client.php
$client_ip = $_SERVER['REMOTE_ADDR'];
which if your app is behind a load balancer, will return the load balancer's IP instead of the end user's ip. Instead, Client.php should check all the x-forwarded-for, etc. headers and try to find the real IP address. for example: https://stackoverflow.com/questions/44085102/php-most-accurate-safe-way-to-get-real-user-ip-address-in-2017

see also, https://groups.google.com/a/apereo.org/forum/#!topic/cas-user/Wte7lwmYkkc

Start with Client.php, especially the $_SERVER['REMOTE_ADDR'] handling, and review the config.php setting for $cas_real_hosts. Reproduce the logout flow behind a load balancer, then verify that the app no longer remains logged in while accounting for the security implications of forwarded headers.