Note that both come from the X-Forwarded-For and X-Real-IP HTTP headers, respectively, and can thus be spoofed. It shouldn't matter when using the load balancing server (since they'll add the clients real IP to the headers), but if you ever migrate your code to another server that doesn't use...