When submitting survey responses, get real client IP address from next.js backend
- Dominant language
- Python
- Stars
- 29
- Forks
- 33
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 19
Description
https://github.com/con2/kompassi/blob/8e15401d09389603679bf0935443d2e970aebe92/backend/forms/graphql/mutations/create_survey_response.py#L36
https://github.com/con2/kompassi/blob/d7409aeb46c6ca8bd3c66593e29e546a0e3b3c2a/frontend/src/app/%5Blocale%5D/events/%5BeventSlug%5D/surveys/%5BsurveySlug%5D/actions.ts
The survey is submitted via a server action, so the network client that performs the mutation is the Next.js backend, not the user's browser. Therefore `Response.ip_address` records the IP address of the Next.js backend, not that of the user.
We don't want just anyone to be able to spoof the IP address in Response, so we may need to add M2M authentication, wrap the IP address in a JWT or similar.
Either way this may prove too much work for such a minor use case, so another option is to remove the `Response.ip_address` field altogether. However, we may have other use cases as well in the future in which we would like to record the IP address of the user, and the IP address is only visible to the kompassi2 next.js backend.
See discussion [in Slack](https://con2.slack.com/archives/C3ZGNGY48/p1705477673903329). Note that direct v1 use cases get the IP addresses right, so this is specific to v2 `forms.Response`, and `event_log.Entry` **when it is created via v2 frontend**.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.