pub fn resolve_client_ip(
peer_ip: IpAddr,
xff: Option<&str>,
trusted: &[IpNet],
) -> IpAddrExpand description
Resolve the real client IP from X-Forwarded-For if the peer is a trusted proxy.
Walks the X-Forwarded-For chain from right to left, stopping at the first IP that is NOT in a trusted subnet. This is the standard secure algorithm (rightmost non-trusted).