Addresses of the proxies in front of this application, as literal addresses or CIDR blocks. When supplied, the header is walked RIGHT to LEFT and the first entry that is not one of these is the client.

This is the standard algorithm, and what Express trust proxy and Fastify trustProxy offer. It matters because the common nginx idiom (proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for) APPENDS the peer address rather than overwriting the header — so with a request sent as X-Forwarded-For: 7.7.7.7 the proxy forwards 7.7.7.7, 198.51.100.9, and the leftmost default resolves the value the caller chose. Rate limits and IP allowlists keyed on that are keyed on attacker input.

Mutually exclusive with IpSecurityOptions.proxyHops; supplying both throws at middleware construction. Omitted, resolution stays leftmost, unchanged from before 0.5.0.