Great write up. Every software engineer (including myself) who has received vague instructions like "rate limit the service based on client IP address" or "only allow requests from these IP ranges" has gone down this rabbit hole.

My TL;DR on the topic is:

1. There's no single correct mechanism for determining the client IP address. Any standards and headers you may have come across are merely hints. Your solution has to be custom-built taking into account your use case, your network topology and the service provider(s) you are reliant on. If any of the above changes, your code has to change as well.

2. There is no single "correct" answer for client IP address, no matter how much effort you put into 1. Any value you come up with is at best an approximation, so treat it as such, especially if you are using the value for something critical like authorization.