X-Forwarded-For IPs ordering issue

[rayrapetyan]

It's not clearly defined in RFC, but in wiki (http://en.wikipedia.org/wiki/X-Forwarded-For), squid (http://www.squid-cache.org/Doc/config/follow_x_forwarded_for/ btw - they're inventors of X-Forwarded-For thing) and varnish and many other proxies real-client IP is the left one.

Line 220:
headers['X-Forwarded-For'] = request.connection.remoteAddress + ", " + headers['X-Forwarded-For'];

Should be:
headers['X-Forwarded-For'] = headers['X-Forwarded-For'] + ", " + request.connection.remoteAddress;

p.s. however, some popular servers, like nginx, break this rule and define most recent address at the left (like in your current implementation).

[nodesocket]

Prefer the nginx implementation. Most recent to the left.