You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
request.ip via x-forwarded-for should strip out ports #827
Weird, I have not seen the port being included on Azure before. It's unfortunate that x-forwarded-for is not a standard in anyway, and is up to specify by any software. But I have never heard of something including anything other than either just the IP address or a hostname before.
Because ports are split from the host by a colon, it's possible that I could simply add the stripping in forwarded, though the load balancers I've seen with IPv6 just include the bare IPv6 address in x-forwarded-for, making blind splitting on the colons a bit harder.
Since X-Forwarded-For is not a standard header, wouldn't it be sane to extract X-Forwarded-For as a separate - "replaceable" - function/repo? Allow user space to modify as needed? Maybe this is a minuscule problem but PaaS's are exploding, all with minor peculiarities.
You already can: Use Object.defineProperty to replace the getter at app.request.ips after you create your app object to whatever function you want to run to get the IPs from any header / parsing method you choose. This is why app.request and app.response exist so you can alter the prototypes.
@jonathanong good to see that this issue is on the radar again. It creates lots of troubles with Azure web apps where port is added to IP. I'm not strong in js but can help testing.
Activity
dougwilson commentedon Oct 4, 2016
Weird, I have not seen the port being included on Azure before. It's unfortunate that
x-forwarded-foris not a standard in anyway, and is up to specify by any software. But I have never heard of something including anything other than either just the IP address or a hostname before.Because ports are split from the host by a colon, it's possible that I could simply add the stripping in
forwarded, though the load balancers I've seen with IPv6 just include the bare IPv6 address inx-forwarded-for, making blind splitting on the colons a bit harder.jonathanong commentedon Oct 4, 2016
yeah, i've never seen it before either. i'm using "App Services", if that matters.
doing it in
forwardedwould be better. i'm currently doingwhich seems to strip out the port correctly. let me know if there's a better method
dougwilson commentedon Oct 4, 2016
Unfortunately that
url.parsetrick seems to fail for the most basic IPv6 test case:dougwilson commentedon Oct 4, 2016
So what we can probably do is the following:
net.isIPv6(ip) === true, then returnipip.lastIndexOf(':') === -1then returnipip = ip.substr(0, ip.lastIndexOf(':'))ip[0] === '[' && ip[ip.length - 1] === ']'then returnip.slice(1, -1)ipThat is a rough draft of what to apply to each address entry. What the overhead of that will be I haven't looked into yet.
fl0w commentedon Oct 4, 2016
Since X-Forwarded-For is not a standard header, wouldn't it be sane to extract
X-Forwarded-Foras a separate - "replaceable" - function/repo? Allow user space to modify as needed? Maybe this is a minuscule problem but PaaS's are exploding, all with minor peculiarities.jonathanong commentedon Nov 26, 2016
@fl0w yes! if someone can get started with a module, we can move it to https://github.com/jshttp if it's good
dougwilson commentedon Nov 26, 2016
The
X-Forwarded-Forparsing is already extracted into a module that only does that: https://github.com/jshttp/forwardedfl0w commentedon Nov 29, 2016
@dougwilson are you suggesting having https://github.com/jshttp/forwarded as a Koa dependency? Seems a bit overkill compared to current
x-forwarded-forheader field parsing, no?dougwilson commentedon Nov 29, 2016
@fl0w you asked:
And I was just pointing out there is already a separate repo. Maybe you can elaborate on what you are asking for?
dougwilson commentedon Nov 29, 2016
@fl0w
You already can: Use Object.defineProperty to replace the getter at app.request.ips after you create your app object to whatever function you want to run to get the IPs from any header / parsing method you choose. This is why app.request and app.response exist so you can alter the prototypes.
fl0w commentedon Nov 29, 2016
@dougwilson I understand now as I went through the lib source. My question came from ignorance. I was pondering about exposing e.g.
It should/would work for all custom headers, not only for x-forwarded-for. But that's something that could be done in user space as you mentioned.
Apologies.
parse port in x-forwarded-for, fixes koajs#827
fix: parse port in x-forwarded-for (koajs#827)
fix: parse port in x-forwarded-for (koajs#827)
nixent commentedon Apr 17, 2025
@jonathanong good to see that this issue is on the radar again. It creates lots of troubles with Azure web apps where port is added to IP. I'm not strong in js but can help testing.
fix: strip port from X-Forwarded-For in request.ip
fix: use forwarded library for X-Forwarded-For port stripping