jetersen/express-ipfilter

Wrong IP Address

drveresh opened this issue · 3 comments

drveresh commented

Hi,

I am using this with Cloud Functions on Firebase/GCP, but it is picking the wrong IP address.

The HTTP headers captured in the CF logs contains below:
{
"x-forwarded-for": "77.234.44.175,66.102.8.142",
"remote": "::ffff:169.254.8.129"
},

There, the IP 66.102.8.142 is the address of the server where it is deployed (CF instance), the IP "77.234.44.175" is the real client IP address who hit that request, and this IP filter should work based on client IP. Instead, it is taking "::ffff:169.254.8.129", and blocking all requests from every other IP address. I guess it's a bug.

Also, can you please give us an API or option to specify which field to refer to in the HTTP header?

Thanks.

jetersen commented

Pull request are welcome.

jetersen commented

@drveresh you can create your own IP detection function:

let allowlist_ips = ['127.0.0.1']

let clientIp = function(req, res) {
  return req.headers['x-forwarded-for'] ? (req.headers['x-forwarded-for']).split(',')[0] : "" // this should pick the first x-forwarded-for ip address
}
  
app.use(
  ipFilter({
    detectIp: clientIp,
    forbidden: 'You are not authorized to access this page.',
    filter: allowlist_ips,
  })
)