Under the hood
Client IP resolution now reports the specific bad hop instead of silently falling back.
The function that resolves the real client IP from X-Forwarded-For against a trusted proxy list now returns a structured result including a badHop field (truncated to 100 characters) when a hop in the chain can't be parsed as an IP, rather than silently falling back to the untrusted original address.
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agree
Fixed Claude apps gateway client IP when a trusted proxy appends a port to X-Forwarded-For; with an access list set, an unreadable entry now…