When true, read the client IP from the proxy header instead of request.ip. Requires a trusted reverse proxy. Default: false.

WARNING: on its own this trusts the header's LEFTMOST entry, which is safe only behind a proxy that OVERWRITES the header. The standard nginx idiom appends instead, in which case the leftmost entry is whatever the client sent — set IpSecurityOptions.trustedProxies or IpSecurityOptions.proxyHops so the client is resolved from the right. Note that with false, clientIp is undefined on all first-party adapters (see the module note).