0

I'm aware that this question has been asked before, but I haven't found a satisfactory solution that takes into account security concerns. In my Node.js backend application, which operates over HTTPS, I need to retrieve the user's real IP address, considering that the user can potentially modify headers, use proxies/VPNs, or employ malicious 3rd-party tools for IP spoofing.

Currently, I'm using standard request headers like X-Forwarded-For, and I discovered that setting the remote address inside the webserver (e.g., nginx) using proxy_set_header X-Real-IP $remote_addr might be useful. However, I'm aware that these headers can be manipulated by the client. Additionally, some users might be behind proxies or VPNs, which can further obfuscate their real IP address.

Given these security challenges, I'm looking for a robust method or a combination of techniques to accurately obtain the real IP address of the user while mitigating the risks posed by header modification, proxies, VPNs, and spoofing attempts.

Any guidance, best practices, or code examples that can enhance the security of IP retrieval in such scenarios would be greatly appreciated.

Thank you!

GisCat
  • 55
  • 2
  • 13
  • Perhaps you should list some of the links you've consulted here already so we can see which answers are already carved out as not fitting for you. – dodrg Jul 27 '23 at 10:01
  • Narf comment resume it well I think, but i don't have a good security background: https://stackoverflow.com/questions/44085102/php-most-accurate-safe-way-to-get-real-user-ip-address-in-2017 – GisCat Jul 27 '23 at 10:20
  • 2
    You will likely NEVER know the client's real IP in many circumstances as it's usually a private, non-unique IP address on a private network. So, whatever you're trying to use this for will probably not work. In many cases, the best IP address you will ever get is a proxy or gateway that is likely shared by many users. You should probably back up several steps and write a question about the real problem you're trying to solve and what best practices are used for that problem. – jfriend00 Jul 27 '23 at 12:10

0 Answers0