13

Cloudflare changes the IP addresses of incomming requests because Cloudflare is a middleware between my website and the Internet, a proxy.

How should I get the initial IP address of the request, not Cloudflare its IP address. I heard about the mod_cloudflare but does this plugin only updates the IP address in my logs (?) And I didn't find a version for Nginx.

3

2 Answers 2

24

Cloudflare sets the CF-Connecting-IP and the X-Forwarded-For headers on every request

You can simply get the IP from their special header:

let ip = req.headers['cf-connecting-ip']

If you expect requests outside of Cloudflare, you can get these IPs the following way:

let otherIp = req.headers['x-forwarded-for'] || req.connection.remoteAddress

Though, be wary, that other Proxies (like Nginx) will also set the x-forwarded-for header.

9
  • Works for third party website requests, I also added my own website to the website and this is the IP that's returned from the req.cf_ip: 2a02:1810:9410:7b00:8829:fc7f:b81f:10f, any idea what this is?
    – Michiel
    Aug 26, 2018 at 14:45
  • An IPv6 address Aug 26, 2018 at 14:45
  • No, you can't transform them to IPv4 addresses, it's a different Version of the internet protocol, get used to them ;-) Aug 26, 2018 at 14:48
  • If I use req.body.remoteAddress then it's a ipv4 address. Isn't there a way to check if the response is ipv4 or ipv6 in Nodejs?
    – Michiel
    Aug 26, 2018 at 14:54
  • 2
    Wouldn't this expose you to spoofing from connections that are not coming through Cloudflare? Hence Cloudflare recommends limiting to connections from their IPs: support.cloudflare.com/hc/en-us/articles/…
    – ewall
    Sep 2, 2021 at 21:04
1

Are you using express? If so you can use the cloudflare-express middleware package to retrieve the IP addresses you need.

var cloudflare = require('cloudflare-express');
...
var express = require('express');
var app = express();
...
app.use(cloudflare.restore({update_on_start:true}));

Then the user's original address appears on req objects as cf_ip.

You may also, if your express app is behind a typical nginx reverse proxy, use express's trust proxy setting.

For example:

    app.set( 'trust proxy', 'loopback' ); //trust localhost reverse proxy

Other request-processing frameworks most likely have their own packages to do similar things.

1
  • Works for third party website requests, I also added my own website to the website and this is the IP that's returned from the req.cf_ip: 2a02:1810:9410:7b00:8829:fc7f:b81f:10f, any idea what this is?
    – Michiel
    Aug 26, 2018 at 14:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.