Struggling with Reliable Client IP Resolution Behind Reverse Proxies?

Hey everyone, I'm reaching out because we're running into a persistent and increasingly complex technical challenge with our "What is my IP Address" tool. Consistently and accurately identifying the true client IP address has become a significant bottleneck, affecting the reliability and accuracy our users expect. Our current infrastructure is quite layered, involving multiple reverse proxies including Cloudflare at the edge, followed by AWS Application Load Balancers (ALB), and then Nginx instances serving our application. The main issue stems from the variability and inherent unreliability of IP information across different HTTP headers. We're constantly juggling `X-Forwarded-For`, `X-Real-IP`, and sometimes even CDN-specific headers like `CF-Connecting-IP` or `True-Client-IP`, each presenting its own set of challenges. We’ve tried to implement a fairly sophisticated logic to parse these headers in a prioritized order, attempting to extract the leftmost non-private IP from `X-Forwarded-For` as the primary source, falling back to `X-Real-IP` if that's unavailable or malformed, and then ultimately resorting to the direct connection IP if all else fails. We even maintain a dynamic list of trusted proxy IPs to validate against, attempting to filter out internal network IPs within the `X-Forwarded-For` chain. However, this approach frequently falters in more complex scenarios, especially with nested proxies where CDNs might chain requests before hitting our ALB, or when a user is behind a corporate proxy that also modifies or adds its own `X-Forwarded-For` entries. We've observed numerous edge cases where `X-Forwarded-For` contains a convoluted string of multiple IPs, some clearly private, some public, and discerning the *true* originating client IP becomes a non-trivial task. There's also the ever-present concern of spoofed headers, which adds a security dimension to the problem. We're really looking for an authoritative, robust, and secure strategy or perhaps a widely accepted best practice for reliably determining the client IP address in such a complex, multi-proxy environment. Are there specific industry standards, well-vetted algorithms, or even open-source libraries designed to gracefully and securely handle these intricate edge cases? Our ultimate goal is to ensure our "What is my IP Address" tool always reports the most accurate public IP of the end-user, irrespective of their specific network configuration or the intricacies of our proxy chain. Any insights or recommendations would be incredibly valuable. Thanks in advance!