Forward client IP chain to session allocator

Preserve the incoming X-Forwarded-For chain for load-balancer network attribution. Requests without the header continue to omit it.

README.md

@@ -31,4 +31,5 @@ Optional:
 - `GET /session-url`: returns the currently configured upstream allocator URL
 - `GET /config`: alias for `/session-url`
 - `POST /session`: proxies the session allocation request to the upstream URL,
-  including a valid incoming bearer `Authorization` header when present
+  including valid incoming bearer `Authorization` and `X-Forwarded-For`
+  headers when present

app.py

@@ -74,6 +74,7 @@ def _upstream_headers(request: Request) -> dict[str, str]:
         "Content-Type": request.headers.get("content-type"),
         "Accept": request.headers.get("accept"),
         "Authorization": _bearer_authorization(request.headers.get("authorization")),
+        "X-Forwarded-For": request.headers.get("x-forwarded-for"),
     }
     headers.update({name: value for name, value in forwarded_headers.items() if value})
     return headers

tests/test_session_proxy.py

@@ -98,8 +98,19 @@ class SessionProxyTests(unittest.IsolatedAsyncioTestCase):
         post = await self.proxy({})
 
         self.assertNotIn("Authorization", post["headers"])
+        self.assertNotIn("X-Forwarded-For", post["headers"])
 
     async def test_does_not_forward_non_bearer_authorization(self):
         post = await self.proxy({"Authorization": "Basic credentials"})
 
         self.assertNotIn("Authorization", post["headers"])
+
+    async def test_forwards_client_ip_chain_to_upstream(self):
+        post = await self.proxy(
+            {"X-Forwarded-For": "203.0.113.8, 10.0.0.4"}
+        )
+
+        self.assertEqual(
+            post["headers"]["X-Forwarded-For"],
+            "203.0.113.8, 10.0.0.4",
+        )