The header name to read when trustProxy is true. Default: X-Forwarded-For.

With neither IpSecurityOptions.trustedProxies nor IpSecurityOptions.proxyHops supplied, the LEFTMOST address is taken — which is the entry a client controls under an appending proxy (see those two options).