Repository: unjs/h3 (ts)

Issue:
`xForwardedFor` returns the last IP address in the `X-Forwarded-For` header
### Environment

Node: v18.16.0
h3 1.9.0

### Reproduction

Call `getRequestIP(event, { xForwardedFor: true })` in an application behind a proxy server.

### Describe the bug

When calling `getRequestIP(event, { xForwardedFor: true })`, the last IP address in the list is returned instead of the first one (the client's IP address), when I assume the first one should be.

### Additional context

_No response_

### Logs

_No response_

Pull request:
fix(getRequestIP): use first address of `x-forwarded-for` header
<!---
☝️ PR title should follow conventional commits (https://conventionalcommits.org) 
-->

### 🔗 Linked issue

resolves #588

### ❓ Type of change

<!-- What types of changes does your code introduce? Put an `x` in all the boxes that apply. -->

- [ ] 📖 Documentation (updates to the documentation, readme, or JSdoc annotations)
- [ ] 🐞 Bug fix (a non-breaking change that fixes an issue)
- [ ] 👌 Enhancement (improving an existing functionality like performance)
- [ ] ✨ New feature (a non-breaking change that adds functionality)
- [ ] 🧹 Chore (updates to the build process or auxiliary tools and libraries)
- [ ] ⚠️ Breaking change (fix or feature that would cause existing functionality to change)

### 📚 Description

<!-- Describe your changes in detail -->
<!-- Why is this change required? What problem does it solve? -->
<!-- If it resolves an open issue, please link to the issue here. For example "Resolves #1337" -->

### 📝 Checklist

<!-- Put an `x` in all the boxes that apply. -->
<!-- If your change requires a documentation PR, please link it appropriately -->
<!-- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->

- [ ] I have linked an issue or discussion.
- [ ] I have updated the documentation accordingly.


Patch:
diff --git a/src/utils/request.ts b/src/utils/request.ts
index f97c790..6f033a5 100644
--- a/src/utils/request.ts
+++ b/src/utils/request.ts
@@ -207,9 +207,11 @@ export function getRequestIP(
   }
 
   if (opts.xForwardedFor) {
+    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For#syntax
     const xForwardedFor = getRequestHeader(event, "x-forwarded-for")
       ?.split(",")
-      ?.pop();
+      .shift()
+      ?.trim();
     if (xForwardedFor) {
       return xForwardedFor;
     }


Test patch:
diff --git a/test/utils.test.ts b/test/utils.test.ts
index 1528906..5eb6140 100644
--- a/test/utils.test.ts
+++ b/test/utils.test.ts
@@ -186,6 +186,19 @@ describe("", () => {
       req.set("x-forwarded-for", "2001:0db8:85a3:0000:0000:8a2e:0370:7334");
       expect((await req).text).toBe("2001:0db8:85a3:0000:0000:8a2e:0370:7334");
     });
+    it("multiple ips", async () => {
+      app.use(
+        "/",
+        eventHandler((event) => {
+          return getRequestIP(event, {
+            xForwardedFor: true,
+          });
+        }),
+      );
+      const req = request.get("/");
+      req.set("x-forwarded-for", "client , proxy1, proxy2");
+      expect((await req).text).toBe("client");
+    });
   });
 
   describe("getRequestFingerprint", () => {