Not an Issue: But wanted to explore if we should include checking "X-Forwarded-For" to make it more robust?

[srsree]

The "X-Forwarded-For" header contains both public and private IPs. Hence will add more robustness to IP checking.
Ex: Forwarded: for=192.0.2.60;proto=http;by=203.0.113.43

Ref: https://en.wikipedia.org/wiki/X-Forwarded-For