portal entry

select a category, or use search below
(searches all categories and all time range)
Title:

How to get CF to know a user’s real IP address, when behind a proxy, load balancer, caching solution, etc.

| View in Portal
April 29, 2019 09:38:13 PM GMT
9 Comments
<p>If your server is behind some loadbalancer, proxy, or caching solution, you may need to know the "real" IP address for a user. Or perhaps you are developer, and because of this same problem, you find that you can never get CF "debugging output" to appear, even though your IP address is in the CF Admin list. See this post, for how to leverage the Tomcat RemoteIPValve, which can be configured easily within CF.</p>
<p>The post <a rel="nofollow" href="https://coldfusion.adobe.com/2019/04/get-cf-know-users-real-ip-address-behind-proxy-load-balancer-caching-solution-etc/">How to get CF to know a user’s real IP address, when behind a proxy, load balancer, caching solution, etc.</a> appeared first on <a rel="nofollow" href="https://coldfusion.adobe.com">ColdFusion</a>.</p>
Labels: Blog, ColdFusion, Troubleshooting, admin, blog, troubleshooting

Comments:

<p>Great article Charlie, as always! </p><p>We had this problem years ago here at work when a new proxy was installed and we found that it wasn’t forwarding the real IP at <em>all</em>. We had to ask our network team to change the configuration in the proxy appliance (I’d prefer not to say the name of the device, for security reasons). After they did that we started seeing X-Forwarded-For in the header data.</p>
Comment by yacoubean
2029 | May 01, 2019 08:28:05 PM GMT
Thanks for the kind regards, Jake. And had you guys used the remoteipvalve to get CF to regard that header? Or was this perhaps before CF10 (and CF's Tomcat integration)?
Comment by Charlie Arehart
2030 | May 02, 2019 03:23:35 AM GMT
Yeah, before CF10.
Comment by yacoubean
2041 | May 07, 2019 06:17:50 PM GMT
Hi Charlie- I did the change on my production server and did not get cgi.REMOTE_ADDR to reflect the IP in the CF-Connecting-IP but a work around I found was to just use this wherever I was using cgi.REMOTE_ADDR: var curIP = cgi.REMOTE_ADDR; if ( structKeyExists(cgi,'CF_Connecting_IP') ) curIP = cgi.CF_Connecting_IP;  
Comment by Matthew Graff
2064 | May 22, 2019 10:39:25 PM GMT
Interesting idea, Matt. Thanks for sharing it. It may help some. As for the remoteipvalve not working, there can be various reasons that would be so. If you visit the Tomcat docs, you'll see the various additional attributes, which solve various problems. See especially the internal_proxies attribute, if there is yet some other proxy within your environment (like a load balancer), whose ip is not in the default list of them: 10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254.\d{1,3}.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|0:0:0:0:0:0:0:1.
Comment by Charlie Arehart
2065 | May 22, 2019 11:55:24 PM GMT
Would you recommend using GetHttpRequestData(false).headers? I believe we had to do this w/Adobe ColdFusion because it defaults to "true" and then headers can only be read once. (CFDocs.org indicates that this flag defaults to "false", but official Adobe documentation indicates that it defaults to "true".)
Comment by James Moberg
2066 | May 23, 2019 02:04:27 PM GMT
James, I would think it would be inconsequential for this need (to get the header). That arg is about whether to get the body, and the stated limitation that you can only get it once seems to be talking about the body instead, not the headers. But if you or anyone gets clarification on it, feel free to share. I have only ever used it without any arg, which (from the docs) defaults to false.
Comment by Charlie Arehart
2067 | May 23, 2019 08:41:37 PM GMT
Hi, this did not work for me on Azure. We added the valve, restarted, and nothing in the headers for the CF-Connecting-IP.
Comment by tribule
2096 | June 07, 2019 11:08:39 AM GMT
Check out the docs for the valve, for additional attributes that may help. As I said in a reply to someone else below, see especially the internal_proxies attribute, if there is yet some other proxy within your environment (like a load balancer), whose ip is not in the default list of them: 10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254.\d{1,3}.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|0:0:0:0:0:0:0:1. If that works, please write back to help confirm for other readers.
Comment by Charlie Arehart
2097 | June 07, 2019 11:25:24 AM GMT