Request logging
Record the apparent client address alongside request metadata for operational diagnostics.
Express.js · Pipe
req.ip
req.ip contains the request's remote IP address as a string. With proxy trust enabled, Express derives it from the left-most X-Forwarded-For entry.
How it works
req.ip is a string property containing the request's remote IP address. If the trust proxy setting is not false, Express derives it from the left-most value in X-Forwarded-For; otherwise it uses the direct connection context.
Syntax
req.ipReturns
String
Key points
- The property exposes the request's remote IP address.
- Proxy-aware behavior applies whenever
trust proxydoes not evaluate to false. - Express selects the left-most forwarded address when proxy trust is active.
Common mistakes
- Do not treat the forwarded value as inherently trustworthy: either the client or a proxy can supply the X-Forwarded-For header.
Example: Read the request IP
const express = require('express');
const app = express();
app.set('trust proxy', true);
app.get('/', (req, res) => {
res.json({ ip: req.ip });
});
app.listen(3000);Returns the request's remote IP address as JSON. With trust proxy enabled, the value can come from the left-most X-Forwarded-For entry.
When to use it
IP-aware request handling
Apply address-based routing or access rules after configuring proxy trust for the deployment.
Interview questions
QWhat does req.ip contain?
req.ip is a string containing the request's remote IP address. When trust proxy is not false, Express derives it from the left-most X-Forwarded-For entry.
Follow-up: What changes when trust proxy is false? Express does not use the forwarded header for this property and treats the application as directly facing the client.
QHow does trust proxy affect req.ip?
The setting controls whether proxy-provided forwarding information participates in determining the address. If it is not false, the left-most forwarded address becomes the value exposed by req.ip.
Follow-up: Why can this be risky? Forwarded headers can be set by clients, so the deployment must establish an appropriate proxy-trust policy.
QHow does req.ip differ from req.ips?
The property is a string, not an array. It represents one selected remote address, while the related req.ips property exposes the forwarded address list when proxy trust is enabled.
Follow-up: Which related property exposes the chain? req.ips returns an array of IP addresses specified in the forwarded request header.
Related
req.ipstrust proxyreq.socket.remoteAddressX-Forwarded-For