diff --git a/CHANGELOG.md b/CHANGELOG.md index ab09da29b7f..37d833a4545 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -21,6 +21,7 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm ### Fixed - json stdout exporter no longer crashes due to concurrency bug. (#2265) +- `http.client_ip` no longer inhales multiple addresses from the `X-Forwarded-For` header. (#2282) ## [Metrics 0.24.0] - 2021-10-01 diff --git a/semconv/v1.4.0/http.go b/semconv/v1.4.0/http.go index 569e3c6450d..844649e5983 100644 --- a/semconv/v1.4.0/http.go +++ b/semconv/v1.4.0/http.go @@ -225,7 +225,9 @@ func HTTPServerAttributesFromHTTPRequest(serverName, route string, request *http attrs = append(attrs, HTTPRouteKey.String(route)) } if values, ok := request.Header["X-Forwarded-For"]; ok && len(values) > 0 { - attrs = append(attrs, HTTPClientIPKey.String(values[0])) + if addresses := strings.Split(values[0], ","); len(addresses) > 0 { + attrs = append(attrs, HTTPClientIPKey.String(addresses[0])) + } } return append(attrs, httpCommonAttributesFromHTTPRequest(request)...) diff --git a/semconv/v1.4.0/http_test.go b/semconv/v1.4.0/http_test.go index 99498705c42..48866137e7f 100644 --- a/semconv/v1.4.0/http_test.go +++ b/semconv/v1.4.0/http_test.go @@ -585,7 +585,7 @@ func TestHTTPServerAttributesFromHTTPRequest(t *testing.T) { }, header: http.Header{ "User-Agent": []string{"foodownloader"}, - "X-Forwarded-For": []string{"1.2.3.4"}, + "X-Forwarded-For": []string{"203.0.113.195, 70.41.3.18, 150.172.238.178"}, }, tls: withTLS, expected: []attribute.KeyValue{ @@ -597,7 +597,7 @@ func TestHTTPServerAttributesFromHTTPRequest(t *testing.T) { attribute.String("http.route", "/user/:id"), attribute.String("http.host", "example.com"), attribute.String("http.user_agent", "foodownloader"), - attribute.String("http.client_ip", "1.2.3.4"), + attribute.String("http.client_ip", "203.0.113.195"), }, }, {