Get the user IP address

[amir-ziaei]

Hi,

I can't figure out how to access the user IP address in the loader. Searched the docs but couldn't find anything either.
I would appreciate your help!

[pckilgore]

You should read this from whatever header you trust most.

It's not a simple problem, see for example: https://adam-p.ca/blog/2022/03/x-forwarded-for/

[ITenthusiasm]

This was actually an incredibly helpful response. I wasn't aware of the dangers of grabbing just any kind of header. In light of @pckilgore's answer, I'm now adding the IP Address to the Remix Context via Express Middleware instead (since there doesn't seem to be any other way to reliably get the true IP).

// Derive IP from Cloudflare, or from regular IP if in local development
const ip = req.headers["cf-connecting-ip"] ?? req.socket.remoteAddress;
if (typeof ip !== "string") return res.send("Client disconnected or forged information...");

// Supply this function to Remix's `getLoadContext` option
const getLoadContext = () => ({ ip });
// ...

Of course, people can replace the Cloudflare header with whatever header they're trusting/expecting, as @pckilgore mentioned. If a reverse proxy isn't being used, then req.socket.remoteAddress is sufficient.

[ITenthusiasm]

@sergiodxa, could the accepted answer be changed? My concern is that other people who stumble into this thread (like me) might consider @machour's approach to be the way to go about this when in fact it might be dangerous.

[martinmckenna]

@ITenthusiasm how the heck do you get req.socket? It doesn't seem to be exposed anywhere

[ITenthusiasm]

The code that I wrote was in Express Land, not Remix Land. (Remix allows you to transfer information from Express to Remix via getLoadContext if you're using the Node Adapter, which I was doing.) If you're using Express, which is built on top of Node's APIs, you should have access to IncomingMessage.socket.

[timothymathison-ms]

If you're running Express, it provides ip and ips methods on the Request object that automatically parse the X-Forwarded-For header, which is the defacto standard for proxies these days. Assuming your proxies are using the standard X-Forwarded-For header, using the built in express methods seems the better way to go for both security and ease of use.

Looking at the source for getClientIpAddress, it looks to me like its vulnerable to spoofing since it takes the first IP it finds in a given header.

Check out: https://expressjs.com/en/guide/behind-proxies.html

[wengzilla]

Wanted to resurface this question... I'm noticing that when I deploy on Fly.io, the request is actually missing the headers set by Fly...

https://fly.io/docs/reference/services/#http

Is that to be expected? Is there any way I can change this behavior?