Cloudflare CF-Connecting-IP save in ip_address

[aftabkhaliq86]

PHP Version

8.1

Laravel Version

10.0

Package Version

13.7.2

Description

i have added the custom IpAddressResolver to save user real ip
Currently, its saving Cloudflare IP, not the original IP wvwn though modified to save the Cloudflare IP with header CF-Connecting-IP . my solution works fine with local and auditing in queue but in production my solutions saves 127.0.0.1

class irUserIPResolver implements  \OwenIt\Auditing\Contracts\Resolver
{
    public static function resolve(Auditable $auditable)
    {
       return  request()->header('CF-Connecting-IP')??request()->ip();
        Log::build([
            'driver' => 'single',
            'path' => storage_path('logs/audit_logs.log'),
            'level' => 'info',
        ])->info('Audirt Logs ',[
            'CF-Connecting-IP' => request()->header('CF-Connecting-IP'),
            'X-Forwarded-For' => trim(explode(',', request()->header('X-Forwarded-For'))[0]),
            'fallback' => request()->ip(),
            'url' => request()->fullUrl(),
        ]);
        // Cloudflare real IP headers
        if (request()->hasHeader('CF-Connecting-IP')) {
            return request()->header('CF-Connecting-IP');
        }

        if (request()->hasHeader('X-Forwarded-For')) {
            // May contain multiple IPs → take the first (real client)
            return trim(explode(',', request()->header('X-Forwarded-For'))[0]);
        }

        // Fallback to Laravel default
        return request()->ip();
    }
}

Steps To Reproduce

'queue' => [
        'enable'     => true,
        'connection' => env('QUEUE_CONNECTION', 'database'),
        'queue'      => 'default',
        'delay'      => 2,
    ],

cloudflare protected site and server using loadbalancer

'resolvers' => [
        'ip_address' => \Modules\IRemitify\Resolvers\irUserIPResolver::class,
        'user_agent' => OwenIt\Auditing\Resolvers\UserAgentResolver::class,
        'url'        => OwenIt\Auditing\Resolvers\UrlResolver::class,
    ],

Possible Solutions

No response

[willpower232]

The resolver just uses what the framework thinks the remote IP address is, in my case when using cloudflare proxying, we update the TrustProxies middleware like this and then all of our application has access to the real IP address of the visitor.

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Middleware\TrustProxies as Middleware;
use Illuminate\Http\Request;

class TrustProxies extends Middleware
{
    /**
     * The trusted proxies for this application.
     *
     * @var array<int, string>|string|null
     */
    protected $proxies = '*';

    /**
     * The headers that should be used to detect proxies.
     *
     * @var int
     */
    protected $headers =
        Request::HEADER_X_FORWARDED_FOR |
        Request::HEADER_X_FORWARDED_HOST |
        Request::HEADER_X_FORWARDED_PORT |
        Request::HEADER_X_FORWARDED_PROTO |
        Request::HEADER_X_FORWARDED_AWS_ELB;

    public function handle(Request $request, Closure $next)
    {
        if (config('services.cloudflare.replace_ip') === true) {
            $this->setRemoteAddr($request);
        }

        return parent::handle($request, $next);
    }

    protected function setRemoteAddr(Request $request): void
    {
        if (($ip = $request->header('Cf-Connecting-Ip')) !== null) {
            $request->server->set('REMOTE_ADDR', $ip);
        }
    }
}

I think this should be your solution rather than providing a custom resolver.

[aftabkhaliq86]

if (($ip = $request->header('Cf-Connecting-Ip')) !== null) {
$request->server->set('REMOTE_ADDR', $ip);
}
@willpower232
Well this solutions also not working as it stil saves the clooudflare ip rather than theuser actual ip Cf-Connecting-Ip

saved ips are
162.158.108.100
172.70.58.147
all are cloudflare ips

[alexvikman]

The proper way to do this is setting set_real_ip_from with Cloudflare's IPs and real_ip_header in nginx, and then setting trustProxies() like this:

        $middleware->trustProxies(
            at: [
                '192.168.1.1', // Or whatever IP
                '10.0.0.0/8',
            ],
            headers: Request::HEADER_X_FORWARDED_FOR |
            Request::HEADER_X_FORWARDED_HOST |
            Request::HEADER_X_FORWARDED_PORT |
            Request::HEADER_X_FORWARDED_PROTO |
            Request::HEADER_X_FORWARDED_AWS_ELB
        );

Anything else is a workaround that is not needed for Laravel to handle this properly.