Using the value last X-Forwarded-For is wrong

(Also see attached PDF for email from Geoff)

Steps to Reproduce

See this PR which can no longer be commented on

IMHO this is exactly wrong. The PR even states that proxies append to the X-Forwarded-For header — which is correct -- but then draws the wrong conclusion by using the last IP as the client.

If proxies append, the last IP is the last proxy, not the original client. So taking the last entry gives you the identity of some part of your own infrastructure, not the user.

It’s true that if there’s exactly one proxy, then the first and last IP are the same -- so the code might still "work." But in that case, this PR doesn't actually change anything either. The behavior only differs once you add more proxies, and that’s exactly when this logic becomes incorrect.

The correct interpretation requires knowing how many proxies are in front, and then extracting the right entry based on that count. The Bugsink docs (disclosure: competing tool, which I wrote) explain this well. To do it right, you need to explicitly configure the number of proxies and extract the client IP accordingly. Anything else will be either spoofable or wrong.

Start by reviewing PR 68884, which the issue identifies as the source of the behavior and discussion. Trace how Sentry interprets X-Forwarded-For and how proxy configuration is represented. Done means the client IP is selected using an explicitly configured proxy count rather than blindly taking the last header value, with behavior covered by the relevant existing tests.