Support Forwarded header (RFC 7239) alongside X-Forwarded-*

[Copilot]

• Explore repository structure and understand existing X-Forwarded-* handling in request.ts
• Implement Forwarded header (RFC 7239) parsing in request.ts
  • Added ForwardedEntry interface and module-level parseForwarded() helper
  • Added #forwarded cache field and #getForwarded() private method on Request
  • Updated get ips(): checks Forwarded: for=... first, falls back to X-Forwarded-For
  • Updated get url(): checks Forwarded: proto=... / Forwarded: host=... on first entry first, falls back to X-Forwarded-Proto / X-Forwarded-Host
  • Updated JSDoc on ip, ips, url to mention the new behaviour
• Added 6 new tests in request.test.ts
• Code review: addressed quoted-string RFC 7230 backslash unescaping and added host-trust comment
• Style: expanded single-line if (!this.#proxy) return []; to multi-line form
• CodeQL scan: 0 alerts

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Support Forwarded header as well as X-Forwarded-*</issue_title>
<issue_description>The header Forwarded replaces the legacy X-Forwarded-* headers and should be supported by oak.</issue_description>

<agent_instructions>Investigate how the Forwarded header is now common, but preserve legacy behaviour.</agent_instructions>

Comments on the Issue (you are @copilot in this section)

@kitsonk Actually wrong issue tagged.

• Fixes Support Forwarded header as well as X-Forwarded-* #658

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[kitsonk]

@copilot I really dislike single line if statements:

Suggested change

	if (!this.#proxy) return [];
	if (!this.#proxy) {
	return [];
	}

[Copilot]

Done in 40bc983.

[kitsonk]

LGTM