http.client_ip contains multiple addresses from X-Forwarded-For

[garthk]

Description

Spec check: should http.client_ip contain multiple addresses?

Environment

• OS: Any
• Architecture: Any
• Go Version: 1.15
• opentelemetry-go version: 1.0.1

Steps To Reproduce

1. Fire up any “hello, world” implementation on port 8090
2. Give it a client and proxy address eg. curl -H 'X-Forwarded-For: 203.0.113.195, 70.41.3.18, 150.172.238.178' :8090
3. Observe http.client_ip trace span attribute value contains multiple addresses: "203.0.113.195, 70.41.3.18, 150.172.238.178"

The code might look like it's choosing the first value, but it's instead pulling the first matching header:

opentelemetry-go/semconv/v1.4.0/http.go

Lines 227 to 229 in cdf67dd

	if values, ok := request.Header["X-Forwarded-For"]; ok && len(values) > 0 {
	attrs = append(attrs, HTTPClientIPKey.String(values[0]))
	}

HTTPServerAttributesFromHTTPRequest returns all values from the first occurrence of the header:

Expected behavior

I expect http.client_ip to return only the first entry from the X-Forwarded-For header.

The HTTP Server Semantic Conventions describe http.client_ip as containing:

The IP address of the original client behind all proxies, if known (e.g. from X-Forwarded-For).

That sounds singular to me, as does the linked MDN document:

X-Forwarded-For: <client>, <proxy1>, <proxy2>

Strikes me we SHOULD take the left-most address only. What do you reckon?

[MrAlias]

Strikes me we SHOULD take the left-most address only. What do you reckon?

Agreed 👍