I am trying to implement some anti-spamming mechanism into my server. I need to know whether req.ip can be faked by the remote hacker in Express.js. Could someone please confirm this with me?
1 Answer
Yes, it can be faked. request.ip
getting it's value from the left most entry of the X-Forwarded-For header, which can be faked.
Express docs: https://expressjs.com/en/api.html#req.ip
-
ok...then is there a way to obtain the real ip which can't be faked? Jul 4, 2018 at 6:23
-
2Well, if you're not behind a proxy, you may try to check for the remote address of the connection itself (
request.connection.remoteAddress
). It's harder to spoof.– zforJul 4, 2018 at 6:30 -
I don't see the documentation for request.connection. Is it deprecated? Jul 4, 2018 at 6:32
-
Nope. it's in the node.js docs. nodejs.org/dist/latest-v10.x/docs/api/… Also can be accessed as
request.socket
:)– zforJul 4, 2018 at 6:38 -
What if you are behind a proxy and you want to obtain the real IP which can't be faked? Oct 6, 2020 at 10:15