When saving data to Firebase database with a Firebase cloud function, I'd like to also write the IP address where the request comes from.
However, req.connection.remoteAddress always returns ::ffff:0.0.0.0. Is there a way to get the actual IP address of the client that makes the request?
The clients IP is in request.ip.
Example:
export const pay = functions.https.onRequest((request, response) => {
console.log(`My IP is ${request.ip}`);
});
The IP address seems to be available in req.headers["x-forwarded-for"].
See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For
Note that if there are proxies in between the interim ip addresses are concatenated towards the end:
X-Forwarded-For: <client_ip>, <proxy_1 : actual-ip-as-seen-by-google> ...
If you are looking for the client ip thru firebase hosting you should use the header fastly-client-ip there will be the real client ip.
This worked for me:
const express = require('express');
const logIP = async (req : any, res : any, next : any) => {
const clientIP = req.headers['x-forwarded-for'] || req.connection.remoteAddress || req.headers['fastly-client-ip'];
}
const logIPApp = express();
logIPApp.use(logIP);
exports.reportIP = functions.https.onRequest(logIPApp);
You can normally find the real client IP as the first entry in the X-Forwarded-For header, but you cannot trust it.
When using Cloud Run (or Cloud Functions gen 2), you can only trust the last entry (appended by the Cloud Run orchestrator itself).
Additionally, I can't find any way to trust the IP address if you are proxying Firebase Hosting.
As explained by this answer https://stackoverflow.com/a/48032910/1513557, you can normally find the client's IP address by taking the first address from the X-Forwarded-For header, which is a comma-separated list of addresses, where each proxy along the way appends the client address it sees.
However the requester can (maliciously) add the X-Forwarded-For header themselves, and each proxy will append to it. In this way the requester can tell you whatever IP address they want.
If you are using Cloud Run (or Cloud Functions gen 2), then as far as I can tell the Cloud Run orchestrator always sits as a proxy in front of your container. This means you can trust the last entry in X-Forwarded-For as this is the client IP seen by Cloud Run itself. The last address is the only address you can trust. Any preceeding addresses in the list could have been provided by the requester or any untrusted proxy along the way.
If you are proxying the the Cloud Run container (or Cloud Function) behind Firebase hosting, then the last address in the list is the Fastly CDN proxy, not the original client address. You might be tempted to use the second-to-last address (or the Fastly-Client-IP header), but you cannot trust this.
If the requester learns the direct address of your Cloud Run container (e.g. <your-service>.a.run.app) then they can make the request directly, and spoof either of those headers.
You may then be tempted to verify that the request is actually coming from Fastly/Firebase Hosting CDN by checking that the last IP address in the list is a trusted server (it appears that the request from the Fastly CDN to Cloud Run uses one of Google's IP ranges), but that doesn't rule out that the request could be coming from a malicious client hosted on Fastly or Google Cloud services.
This means you can't do it. You can only trust that last address, so you cannot proxy via Firebase Hosting. Unless the GCP/Firebase Hosting teams provide some "trusted header" in the future.
This is what worked for me using Firebase Cloud Functions:
const clientIP = req.headers['x-appengine-user-ip'] || req.header['x-forwarded-for']
Note, that this doesn't work locally!
The previous answers are helpful, and I particularly appreciated the longer explanation from Brett.
If you come across this thread while specifically looking for how to get the client IP address in a 2nd generation onCall cloud function, the prior answers explain it conceptually but don't give a real example. The exact way to do it is:
exports.exampleFunction = onCall({cors: true}, (request) => {
var index = request.rawRequest.rawHeaders.indexOf('x-forwarded-for');
console.log(request.rawRequest.rawHeaders[index+1]);
});
In a 2nd generation onCall function, request.rawRequest.rawHeaders is an array. You look for the array value with x-forwarded-for, then the IP address is the next element in the array after this one.
Sharing this in case it is helpful to others.
And this feels like a clunky way to get it, so if there is a better method for 2nd generation functions, I'd love to know.
To obtain the client IP address in a Firebase cloud function, I've created the following code:
function getIPFromRequest(request: any) {
return (
request.ip ||
request.headers['fastly-client-ip'] ||
request.headers['x-forwarded-for']?.split(',')[0].trim() ||
request.connection.remoteAddress ||
request.socket.remoteAddress ||
''
);
}
In certain Node.js frameworks or middleware like Express.js, you can access the client's IP address using request.ip. And in principle, the request.ip is actually set by fetching the headers. But assuming request.ip was not set, we just fetch the headers ourselves. This is what getIPFromRequest does in simple terms.
The only method documented and thus supported by Firebase / GCloud Functions is the 'X-Forwarded-For' header:
Reference:
As of August 2023, the code now I use is ...
const header = ctx.rawRequest.header.bind(ctx.rawRequest)
const ip = (header('x-forwarded-for') || '').split(',')[0]
const ipCountry = header('x-appengine-country') || ''
Note that x-appengine-user-ip no longer works as it returns an IP address that is not the client's IP (looks like a server or proxy IP).
If you are looking for ip address or headers in cloud callable function, then you can get information inside context object.
for ex:
exports.testUser = async (data, context) => {
console.log('------------------------::context::------------------');
if(context.rawRequest && context.rawRequest.headers){
console.log(context.rawRequest.headers);
}
}
In the headers you can get ip : header { 'x-appengine-user-ip' : 'xxip' } etc.
