supercharge / request-ip

Retrieve a request’s IP address in Node.js

Request IP

Retrieve a request’s IP address

Installation · Usage · Detecting the IP Address

Follow @marcuspoehls and @superchargejs for updates!

---

Introduction

The @supercharge/request-ip package provides a function to retrieve a request’s IP address.

Installation

npm i @supercharge/request-ip

Usage

const RequestIp = require('@supercharge/request-ip')

const ip = RequestIp.getClientIp(request)

// for example '213.211.254.97' as an IP v4 address
// or '2001:0db8:85a3:0000:0000:8a2e:0370:7334' as an IP v6 address
// or 'undefined' if no IP address is available on the given request

Depending on your used web framework, you may use it in a middleware or route handler:

simple Express example

const { getClientIp } = require('@supercharge/request-ip')

const expressMiddleware = function (req, res, next) {
  req.ip = getClientIp(req)

  next()
}

simple hapi route handler example:

const Hapi = require('@hapi/hapi')
const { getClientIp } = require('@supercharge/request-ip')

const server = new Hapi.Server({
  host: 'localhost'
})

server.route({
  method: 'GET',
  path: '/login',
  handler: (request, h) => {
    const ip = getClientIp(request)

    return h.response(ip)
  }
})

Detecting the IP Address

The client’s IP address may be stored in different locations of the request instance varying between services.

Here’s the order of locations in which the packages searches for the requesting IP address:

1. Checks HTTP request headers
   1. x-forwarded-for: this header may contain multiple IP address for (client/proxies/hops). This package extracts and returns the first IP address.
   2. x-forwarded, forwarded, forwarded-for as variants from x-forwarded-for possibly configured by proxies
   3. x-client-ip possibly configured by nginx
   4. x-real-ip possibly configured in nginx
   5. cf-connecting-ip from Cloudflare
   6. fastly-client-ip from Fastly and Firebase
   7. true-client-ip from Akamai and Cloudflare
   8. x-cluster-client-ip from Rackspace
2. Checks the HTTP connection in request.connection and request.connection.socket
3. Checks the HTTP socket in request.socket
4. Checks the HTTP info in request.info
5. Checks the raw HTTP request instance in request.raw
6. Checks the request context used by AWS API Gateway/Lambda in request.requestContext

Credits

A huge thank you to Petar Bojinov for his request-ip package. I was using Petar’s package for two years in my hapi-rate-limitor plugin. It seems Petar is busy with other work and I felt the need to create my own package providing the functionality to retrieve a request’s IP address.

Contributing

Do you miss a way to find the request’s IP? We very much appreciate your contribution! Please send in a pull request 😊

1. Create a fork
2. Create your feature branch: git checkout -b my-feature
3. Commit your changes: git commit -am 'Add some feature'
4. Push to the branch: git push origin my-new-feature
5. Submit a pull request 🚀

License

MIT © Supercharge

---

superchargejs.com  ·  GitHub @supercharge  ·  Twitter @superchargejs

request-ip's Issues

Deprecation of request.connection

In https://nodejs.org/api/http.html#http_request_connection, now the conventional object to get the IP address is request.socket. Usage of this module with Fastify also introduces a FastifyDeprecation warning:

(node:95815) [FSTDEP005] FastifyDeprecation: You are accessing the deprecated "request.connection" property. Use "request.socket" instead.

Error: Can't resolve 'net' in `node_modules/@supercharge/request-ip/dist`

Can't run the package, keep getting 'module not found' error for net. Observed with 1.1.2

pbojinov / request-ip vs supercharge/request-ip

Hi Marcus,

I came here from pbojinov/request-ip#33

I'd be willing to switch my app to your package.
Can you maybe add a bit info, maybe even to the README as I assume other will look for the same inital bits of information:

• do you have feature parity with petars request-ip?
• do you have any fixes/additions in addition to his package?
• what else? why would one want to switch or not?

Thanks much for the info 👍

Filter internal addresses from X-Forwarded-For (and the like)

Linking relevant ticket from upstream repo: pbojinov/request-ip#24

Would be a great feature. Let me know if you don't have time and I can push a PR.