trim extra IPs from x-forwarded-for header

controller/ip.go

@@ -14,6 +14,8 @@ func ResolveIP(app *model.AppState, r *http.Request) string {
     if slices.Contains(app.Config.TrustedProxies, addr) {
         forwardedFor := r.Header.Get("x-forwarded-for")
         if len(forwardedFor) > 0 {
+            // discard extra IPs; cloudflare tends to append their nodes
+            forwardedFor = strings.Split(forwardedFor, ", ")[0]
             return forwardedFor
         }
     }