Earlier today, I added a "ProxyList" component to #swad to get a list of proxies and, ideally, the "real" remote address for requests. It supports the custom (de-facto standard) X-Forwarded-For #header as well as the #Forwarded header specified in #RFC7239.
Well, I just learned I'll have to revisit this implementation with these horrible issues with the standardized(!) flavor in mind: