Hi everyone, what was the reasoning behind this PR? https://github.com/ory/kratos/pull/4048 Was using request headers to grab the client IP and other metadata, and this list seems very arbitrary.

I believe the reason was to not accidentally leak information to webhook targets (especially in Ory Network). The list is a combination of common headers sent by the browser, as well as headers we deemed safe. What specific headers are you missing?

It's the first time I'm seeing True-Client-Ip be exclusively used for client IPs, and my proxy didn't include that- would it be possible to split this into a config value? I could possibly work on it if yes