Fix: http.client_ip vs multiple addresses #2282

CHANGELOG.md

@@ -21,6 +21,7 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 ### Fixed
 
 - json stdout exporter no longer crashes due to concurrency bug. (#2265)
+- `http.client_ip` no longer inhales multiple addresses from the `X-Forwarded-For` header. (#2282)
 
 ## [Metrics 0.24.0] - 2021-10-01
 

semconv/v1.4.0/http.go

@@ -225,7 +225,9 @@ func HTTPServerAttributesFromHTTPRequest(serverName, route string, request *http
 		attrs = append(attrs, HTTPRouteKey.String(route))
 	}
 	if values, ok := request.Header["X-Forwarded-For"]; ok && len(values) > 0 {
-		attrs = append(attrs, HTTPClientIPKey.String(values[0]))
+		if addresses := strings.SplitN(values[0], ",", 2); len(addresses) > 0 {
+			attrs = append(attrs, HTTPClientIPKey.String(addresses[0]))
+		}
 	}
 
 	return append(attrs, httpCommonAttributesFromHTTPRequest(request)...)

semconv/v1.4.0/http_test.go

@@ -585,7 +585,7 @@ func TestHTTPServerAttributesFromHTTPRequest(t *testing.T) {
 			},
 			header: http.Header{
 				"User-Agent":      []string{"foodownloader"},
-				"X-Forwarded-For": []string{"1.2.3.4"},
+				"X-Forwarded-For": []string{"203.0.113.195, 70.41.3.18, 150.172.238.178"},
 			},
 			tls: withTLS,
 			expected: []attribute.KeyValue{
@@ -597,7 +597,7 @@ func TestHTTPServerAttributesFromHTTPRequest(t *testing.T) {
 				attribute.String("http.route", "/user/:id"),
 				attribute.String("http.host", "example.com"),
 				attribute.String("http.user_agent", "foodownloader"),
-				attribute.String("http.client_ip", "1.2.3.4"),
+				attribute.String("http.client_ip", "203.0.113.195"),
 			},
 		},
 		{