diff --git a/packages/hydrooj/src/service/layers/base.ts b/packages/hydrooj/src/service/layers/base.ts
index 740ee7981..4ff10f485 100644
--- a/packages/hydrooj/src/service/layers/base.ts
+++ b/packages/hydrooj/src/service/layers/base.ts
@@ -34,6 +34,7 @@ export default async (ctx: KoaContext, next: Next) => {
         json: (ctx.request.headers.accept || '').includes('application/json'),
         websocket: ctx.request.headers.upgrade === 'websocket',
     };
+    request.ip = request.ip.split(',')[0].trim();
     const response: HydroResponse = {
         body: {},
         type: '',
diff --git a/packages/hydrooj/src/service/layers/domain.ts b/packages/hydrooj/src/service/layers/domain.ts
index cbe8d43c1..ac646dcc9 100644
--- a/packages/hydrooj/src/service/layers/domain.ts
+++ b/packages/hydrooj/src/service/layers/domain.ts
@@ -8,7 +8,8 @@ export default async (ctx, next) => {
     ctx.originalPath = ctx.request.path;
     ctx.path = ctx.request.path = ctx.request.path.replace(/^\/d\/[^/]+\//, '/');
     const [xff, xhost] = system.getMany(['server.xff', 'server.xhost']);
-    const ip = ctx.request.headers[xff?.toLowerCase() || ''] as string || ctx.request.ip;
+    let ip = ctx.request.headers[xff?.toLowerCase() || ''] as string || ctx.request.ip;
+    ip = ip.split(',')[0].trim();
     const host = ctx.request.headers[xhost?.toLowerCase() || ''] as string || ctx.request.host;
     const header = ctx.request.headers.authorization;
     const sid = header