6

I am trying to implement some anti-spamming mechanism into my server. I need to know whether req.ip can be faked by the remote hacker in Express.js. Could someone please confirm this with me?

1 Answer 1

5

Yes, it can be faked. request.ip getting it's value from the left most entry of the X-Forwarded-For header, which can be faked.

Express docs: https://expressjs.com/en/api.html#req.ip

5
  • ok...then is there a way to obtain the real ip which can't be faked? Jul 4, 2018 at 6:23
  • 2
    Well, if you're not behind a proxy, you may try to check for the remote address of the connection itself (request.connection.remoteAddress). It's harder to spoof.
    – zfor
    Jul 4, 2018 at 6:30
  • I don't see the documentation for request.connection. Is it deprecated? Jul 4, 2018 at 6:32
  • Nope. it's in the node.js docs. nodejs.org/dist/latest-v10.x/docs/api/… Also can be accessed as request.socket :)
    – zfor
    Jul 4, 2018 at 6:38
  • What if you are behind a proxy and you want to obtain the real IP which can't be faked? Oct 6, 2020 at 10:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.