Ability to override request.ip (and maybe omit it entirely)

[ItalyPaleAle]

Thanks for this package, it's exactly what I needed.

My only problem is that the app is behind a proxy, so r.RemoteAddr is always the IP of the proxy, which is of limited use. It would be very helpful to be able to alter this value, for example so it's read from a configurable header.

I think this could be implemented in two ways:

1. Add an option for the sloghttp object that is a callback that allows returning the IP of the client, so the app developer will choose how to compute that
2. Allow specifying the IP ranges of "trusted proxies" (e.g. TrustedProxies: []string{"10.0.0.0/8"}). When RemoteAddr is the one of a trusted proxy, read the value of X-Forwarded-For. It should be possible to make the header's name configurable too (e.g. use X-Real-IP or something else)

While we're at it, I think it would be helpful to add an option to omit the IP entirely in the log, since IPs are normally considered PII and can create compliance issues with privacy regulations.

[samber]

I suppose we can find inspiration in fiber implem: https://github.com/gofiber/fiber/blob/e92ec218197b2c81901b37820cea3be78e8b376c/req.go#L377

I would add 2 format in the attributes:

• the user ip as attribute "ip"
• the chain of proxies ips as "x-forwarded-for" attribute (slice)

WDYT ?

[ItalyPaleAle]

This is up to you. I personally would be ok with just a single ip that is the "real IP" (of the end user). Having the full chain of IPs could be a nice-to-have but not sure how helpful it would be eventually.

FWIW, as far as I know, the Go OpenTelemetry SDK only returns a single IP and it's the "real IP"

[samber]

TBH, this is mostly to ease the middleware maintenance: i try to keep the 5 libraries in sync. 😅

slog-fiber has this naming, but we can change it if we consider it useful.