Accurate client IP detection

Oct 13, 2025 by magicalceylontours.com 135 views

[bug]: X-Forwarded-For and X-Real-IP are not respected

In a distributed system, it's common to have multiple layers of proxies and load balancers to handle incoming requests. However, when it comes to identifying the client's IP address, things can get complicated. In this article, we'll explore the issue of X-Forwarded-For and X-Real-IP not being respected in the Plane instance, and how it affects the accuracy of client IP detection.

Is there an existing issue for this?

Before we dive into the details, let's check if there's an existing issue for this problem. After searching the existing issues, we found that this is a known issue that needs to be addressed.

Current behavior

Currently, the existing code fetches the client IP with REMOTE_ADDR from the request metadata. This is incorrect behind a reverse proxy, as it will return the IP address of the proxy server instead of the client's IP address. This is a common problem in distributed systems, and it's essential to use the correct headers to get the client's IP address.

Code exists to use X-Forwarded-For, but it is entirely unused

Interestingly, there's code that exists to use X-Forwarded-For, but it's entirely unused. This code is located in the plane/utils/ip_address.py file, and it's not being utilized anywhere in the system. This is a missed opportunity to improve the accuracy of client IP detection.

Steps to reproduce

To reproduce this issue, follow these steps:

Log in to a correctly configured reverse proxied Plane instance.
Check the last_login_ip field; it will not match the sent X-Forwarded-For header.

Environment

This issue is observed in the production environment.

Browser

The issue is observed in Mozilla Firefox.

Variant

This issue is observed in the self-hosted variant.

Version

The issue is observed in version v0.25.1.

Why is X-Forwarded-For important?

X-Forwarded-For is an important header that contains the client's IP address. When a request passes through multiple proxies and load balancers, the client's IP address is lost, and the proxy server's IP address is returned instead. By using X-Forwarded-For, we can get the client's IP address accurately.

How to fix this issue?

To fix this issue, we need to update the code to use X-Forwarded-For instead of REMOTE_ADDR. We can do this by modifying the plane/utils/ip_address.py file to use the X-Forwarded-For header. We also need to make sure that the X-Forwarded-For header is being sent correctly by the proxy server.

Benefits of using X-Forwarded-For

Using X-Forwarded-For has several benefits, including:

Accurate client IP detection: By using X-Forwarded-For, we can get the client's IP address accurately, even behind multiple proxies and load balancers.
Improved security: By knowing the client's IP address, we can improve the security of our system by blocking malicious IP addresses.
Better analytics: By using X-Forwarded-For, we can get more accurate analytics data, which can help us understand our users' behavior better.

In conclusion, X-Forwarded-For and X-Real-IP are not respected in the Plane instance, which affects the accuracy of client IP detection. By using X-Forwarded-For, we can get the client's IP address accurately, even behind multiple proxies and load balancers. We need to update the code to use X-Forwarded-For instead of REMOTE_ADDR, and make sure that the X-Forwarded-For header is being sent correctly by the proxy server. This will improve the security and analytics of our system, and provide a better user experience.
[bug]: X-Forwarded-For and X-Real-IP are not respected - Q&A

In our previous article, we discussed the issue of X-Forwarded-For and X-Real-IP not being respected in the Plane instance. This issue affects the accuracy of client IP detection, which is crucial for security and analytics purposes. In this article, we'll answer some frequently asked questions (FAQs) related to this issue.

Q: What is X-Forwarded-For?

A: X-Forwarded-For is an HTTP header that contains the client's IP address. When a request passes through multiple proxies and load balancers, the client's IP address is lost, and the proxy server's IP address is returned instead. By using X-Forwarded-For, we can get the client's IP address accurately.

Q: Why is X-Forwarded-For not being respected in the Plane instance?

A: The existing code fetches the client IP with REMOTE_ADDR from the request metadata, which is incorrect behind a reverse proxy. This is because REMOTE_ADDR returns the IP address of the proxy server instead of the client's IP address.

Q: How can we fix this issue?

A: To fix this issue, we need to update the code to use X-Forwarded-For instead of REMOTE_ADDR. We can do this by modifying the plane/utils/ip_address.py file to use the X-Forwarded-For header. We also need to make sure that the X-Forwarded-For header is being sent correctly by the proxy server.

Q: What are the benefits of using X-Forwarded-For?

A: Using X-Forwarded-For has several benefits, including:

Accurate client IP detection: By using X-Forwarded-For, we can get the client's IP address accurately, even behind multiple proxies and load balancers.
Improved security: By knowing the client's IP address, we can improve the security of our system by blocking malicious IP addresses.
Better analytics: By using X-Forwarded-For, we can get more accurate analytics data, which can help us understand our users' behavior better.

Q: How can we ensure that the X-Forwarded-For header is being sent correctly by the proxy server?

A: To ensure that the X-Forwarded-For header is being sent correctly by the proxy server, we need to configure the proxy server to include the client's IP address in the X-Forwarded-For header. We can do this by adding the following configuration to the proxy server:

X-Forwarded-For: client_ip_address

Q: What are the common mistakes that can lead to this issue?

A: Some common mistakes that can lead to this issue include:

Not configuring the proxy server to include the client's IP address in the X-Forwarded-For header
Not updating the code to use X-Forwarded-For instead of REMOTE_ADDR
Not testing the system behind a reverse proxy

Q: How can we test the system behind a reverse proxy?

A: To test the system behind a reverse proxy, we can use a tool like curl to send a request to the system with the X-Forwarded-For header set to the client's IP address. We can do this by running the following command:

curl -H "X-Forwarded-For: client_ip_address" http://system_url