I finally went and dug through the git logs to try finding why Elli ever used x-forwarded-for for the peer and there does not appear to be an explanation. So I think simply removing it is the best course of action.
Coverage increased (+0.07%) to 76.027% when pulling 27b2132280ab1fab94a3e739d93be4dc502e97e8 on tsloughter:peername into 966e89a314d32d5ed2ba6fa640d48115eef0b858 on elli-lib:develop.
Coverage increased (+0.07%) to 76.027% when pulling 27b2132280ab1fab94a3e739d93be4dc502e97e8 on tsloughter:peername into 966e89a314d32d5ed2ba6fa640d48115eef0b858 on elli-lib:develop.
Coverage increased (+0.07%) to 76.027% when pulling 27b2132280ab1fab94a3e739d93be4dc502e97e8 on tsloughter:peername into 966e89a314d32d5ed2ba6fa640d48115eef0b858 on elli-lib:develop.
Coverage increased (+0.07%) to 76.027% when pulling 27b2132280ab1fab94a3e739d93be4dc502e97e8 on tsloughter:peername into 966e89a314d32d5ed2ba6fa640d48115eef0b858 on elli-lib:develop.
Coverage increased (+0.07%) to 76.027% when pulling 27b2132280ab1fab94a3e739d93be4dc502e97e8 on tsloughter:peername into 966e89a314d32d5ed2ba6fa640d48115eef0b858 on elli-lib:develop.
Coverage increased (+0.07%) to 76.027% when pulling 27b2132280ab1fab94a3e739d93be4dc502e97e8 on tsloughter:peername into 966e89a314d32d5ed2ba6fa640d48115eef0b858 on elli-lib:develop.
Coverage increased (+0.07%) to 76.027% when pulling 27b2132280ab1fab94a3e739d93be4dc502e97e8 on tsloughter:peername into 966e89a314d32d5ed2ba6fa640d48115eef0b858 on elli-lib:develop.
Coverage increased (+0.07%) to 76.027% when pulling 27b2132280ab1fab94a3e739d93be4dc502e97e8 on tsloughter:peername into 966e89a314d32d5ed2ba6fa640d48115eef0b858 on elli-lib:develop.
Coverage increased (+0.07%) to 76.027% when pulling 27b2132280ab1fab94a3e739d93be4dc502e97e8 on tsloughter:peername into 966e89a314d32d5ed2ba6fa640d48115eef0b858 on elli-lib:develop.
This was brought to our attention in this issue https://github.com/elli-lib/elli/issues/68
I finally went and dug through the git logs to try finding why Elli ever used x-forwarded-for for the peer and there does not appear to be an explanation. So I think simply removing it is the best course of action.