What is a common mistake with external traffic policy and client IP in Ingress?

Trusting X-Forwarded-For from arbitrary clients can allow spoofing. In practice, the value of this concept comes from understanding where it belongs in the architecture, what problem it solves, and what constraints or tradeoffs it introduces.