parse-community / parse-community/parse-server
Cloud Code Trigger `request.ip` no longer returns the client IP, but rather server instance IP
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 21.4k
- Forks
- 4.8k
- Avg merge
- 7h 45m
- Merged PRs (30d)
- 11
Description
New Issue Checklist
- I am not disclosing a vulnerability.
- I am not just asking a question.
- I have searched through existing issues.
- I can reproduce the issue with the latest version of Parse Server.
Issue Description
I rely on request.ip in my cloud code triggers to determine what IP address is making the request. In the past request.ip always included the original client IP address no matter how many reverse proxies or load balancers are present in front of the parse-server itself. Recently, since one of the alpha releases, request.ip returns the IP of the machine on which the parse server instance is running.
Steps to reproduce
Parse.Cloud.afterLogin(async request => {
console.log(request.ip);
});
Actual Outcome
Since recent alpha releases request.ip returns IP address of the machine where parse server is running, instead of the client's IP.
Expected Outcome
I assume for ease of use, I'd be interested in request.ip giving me back the original IP that made the request. I can examine the complete request path by looking at request.headers["x-forwarded-for"]. But request.ip should be IMHO the original client.
Workaround
I can for the moment workaround the issue by looking at the first item in request.headers["x-forwarded-for"].
const forwarded = request.headers["x-forwarded-for"] || request.ip;
const ip = forwarded.split(",", 1)[0];
Environment
Server
- Parse Server version: alpha
- Operating system: Linux
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start from the Parse.Cloud.afterLogin entry point and trace how request.ip is populated when reverse proxies or load balancers set x-forwarded-for. Compare request.ip with the first forwarded address and confirm the expected client IP behavior through a regression test for proxied requests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- express, javascript, node.js
- Domain
- api, backend, networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100