Is there an existing issue for this?

• I have checked for existing issues https://github.com/getsentry/sentry-javascript/issues
• I have reviewed the documentation https://docs.sentry.io/
• I am using the latest SDK release https://github.com/getsentry/sentry-javascript/releases

How do you use Sentry?

Sentry Saas (sentry.io)

Which SDK are you using? If you use the CDN bundles, please specify the exact bundle (e.g. bundle.tracing.min.js) in your SDK setup.

@sentry/remix

SDK Version

7.38.0

Framework Version

Remix 1.13.0

Link to Sentry event

https://syncwith.sentry.io/issues/3955446273/events/fef107a39ec64e20ad358cf5f26396d1/?project=5880196

SDK Setup

client:

  init({
    beforeSend,
    dsn: SENTRY_ADDON_DSN,
    tracesSampleRate: getApp() === 'syncwith' ? 1 : 0.05,
    sendDefaultPii: true,
    normalizeDepth: 6, // stringify deeper objects
    integrations: [
      new BrowserTracing({
        routingInstrumentation: remixRouterInstrumentation(
          useEffect,
          useLocation,
          useMatches
        ),
      }),
    ],
  });

server:

  init({
  beforeSend,
  sendDefaultPii: true,
  dsn: SENTRY_ADDON_DSN,
  tracesSampleRate: getApp() === 'syncwith' ? 1 : 0.05,
  normalizeDepth: 6, // stringify deeper objects
  integrations: [
    // enable HTTP calls tracing
    new Integrations.Http({ tracing: true }),
    new Integrations.RequestData({
      include: {
        ip: true,
      },
    }),
  ],
});

Steps to Reproduce

We're using a cloudflare worker in front of our website, and cloudflare cdn, and in this request:

https://syncwith.sentry.io/issues/3955446273/events/fef107a39ec64e20ad358cf5f26396d1/?project=5880196

It appears that the user was identified using IP address 141.101.69.35, which is a cloudflare IP. The correct IP to identify the user with is 2a01:cb19:8350:ed00:d0dd:fa5b:de31:8be5 found in header Cf-Connecting-Ip.

I wonder if the bug is that sentry should let Cf-Connecting-Ip take precendence over X-Forwarded-For, or, if its not properly parsing X-Forwarded-For and extracting the relevant IP (the first, not the last, in this case)

Expected Result

The user should be identified by the IP address found in cf-connecting-ip, or maybe first in x-forwarded-for

Actual Result

The user was identified by the wrong IP