origin: use remote address not host if x-forwarded-for is not set

useragent.go

@@ -10,20 +10,24 @@ import (
 
 // Origin contins request origination context from parsing request headers.
 type Origin struct {
+	// about the request
 	Method    string
 	Host      string
+	UserAgent useragent.UserAgent
+
+	// about the requesting entity
+	Remote    string
 	Forward   string
 	Reference string
-	UserAgent useragent.UserAgent
 }
 
 // From returns the value of the X-Forwarded-For if set, otherwise defaulting
-// to the Host header.
+// to the Remote address.
 func (o *Origin) From() string {
 	if o.Forward != "" {
 		return o.Forward
 	}
-	return o.Host
+	return o.Remote
 }
 
 // Anchor returns a parsed version of the Referer headers, including the domain
@@ -67,15 +71,17 @@ func (o *Origin) String() string {
 func Origins(r *http.Request) *Origin {
 	method := strings.ToUpper(r.Method)
 	host := r.Host
+	remote := r.RemoteAddr
 	forward := r.Header.Get("X-Forwarded-For")
 	reference := r.Header.Get("Referer")
 	agent := r.Header.Get("User-Agent")
 	ua := useragent.Parse(agent)
 	return &Origin{
 		Method:    method,
 		Host:      host,
+		UserAgent: ua,
 		Forward:   forward,
+		Remote:    remote,
 		Reference: reference,
-		UserAgent: ua,
 	}
 }

useragent_test.go

@@ -14,21 +14,23 @@ func TestOrigin_From(t *testing.T) {
 
 	t.Run("forward set", func(t *testing.T) {
 		o := &Origin{
-			Host:    "10.0.0.1",
-			Forward: "example.com",
+			Host:    "example.com",
+			Forward: "10.0.0.1",
+			Remote:  "100.100.1.1",
 		}
 
 		s := o.From()
-		must.Eq(t, "example.com", s)
+		must.Eq(t, "10.0.0.1", s)
 	})
 
 	t.Run("not set", func(t *testing.T) {
 		o := &Origin{
-			Host: "10.0.0.1",
+			Host:   "example.com",
+			Remote: "100.100.1.1",
 		}
 
 		s := o.From()
-		must.Eq(t, "10.0.0.1", s)
+		must.Eq(t, "100.100.1.1", s)
 	})
 }