Request.UserHostAddress return IP address of Load Balancer

Question

I have a critical line of code in my site that worked in our development environment but not on production. Well, I say it worked in development but the truth is it gave ::1, which is the IPv6 loopback address.

Anyway, what I wanted to do was capture the IP address of the user who came to the site. I therefore, used Request.UserHostAddress to do that. On development, as I said, it gave me the loopback address, which is correct, since I was running the site from my machine. On live it did something entirely different. It always returned the address of the load balancer.

What I am trying to understand is this. Was I wrong to use Request.UserHostAddress to capture the user's IP address or is there something wrong with our network setup or something else?

Thanks,

Sachin

Solution 1

From within your own application, if nothing else has been done to help you, you're stuck. That's as much information as is available to you.

If you're lucky, your load-balancer has been configured to add one or more extra headers with information about the original request.

One common solution is the X-Forwarded-For header:

The X-Forwarded-For (XFF) HTTP header field is a de facto standard for identifying the originating IP address of a client connecting to a web server through an HTTP proxy or load balancer.

which you would then access via the Request.Headers property.

But discovering whether this (or another) header is available is not something we can help with - you need to talk to the people who configured the load balancer for your organization.

Solution 2

In reference to @Damien_The_Unbeliever's answer, here's the complete solution:

public static string GetIpAddress()
{
  var request = HttpContext.Current.Request;
  // Look for a proxy address first
  var ip = request.ServerVariables["HTTP_X_FORWARDED_FOR"];

  // If there is no proxy, get the standard remote address
  if (string.IsNullOrWhiteSpace(ip)
      || string.Equals(ip, "unknown", StringComparison.OrdinalIgnoreCase))
    ip = request.ServerVariables["REMOTE_ADDR"];
  else
  {
    //extract first IP
    var index = ip.IndexOf(',');
    if (index > 0)
      ip = ip.Substring(0, index);

    //remove port
    index = ip.IndexOf(':');
    if (index > 0)
      ip = ip.Substring(0, index);
  }

  return ip;
}

Solution 3

Used this code to inspect production environment... It worked for me:

    System.Web.HttpRequest oRequest = System.Web.HttpContext.Current.Request;

    string header;
    string ip;

    header = "HTTP_X_FORWARDED_FOR";
    ip = oRequest.ServerVariables[header];
    Response.Write(string.Format("{0} - {1}", header, ip) + Environment.NewLine);

    header = "REMOTE_ADDR";
    ip = oRequest.ServerVariables[header];
    Response.Write(string.Format("{0} - {1}", header, ip) + Environment.NewLine);

    header = "HTTP_CLIENT_IP";
    ip = oRequest.ServerVariables[header];
    Response.Write(string.Format("{0} - {1}", header, ip) + Environment.NewLine);

    header = "Request.UserHostAddress";
    ip = oRequest.UserHostAddress;
    Response.Write(string.Format("{0} - {1}", header, ip) + Environment.NewLine);

Comments

[It's a trap]

if the forwarded address contains more than one address, then how can we identify the correct one?

[Necoras]

Can you add some explanation of what exactly this is doing rather than just a dump of code?

[To Ka]

@It'satrap when there are several IP addresses, the first one defines the client's address, the rest are proxy addresses. It is usually like the following client1, proxy1, proxy2.

[Admin]

When I said that "Used this code to inspect production environment" I mean that are several ways to retrieve client IP, but with a little differences between each other. What I did is to print all variables to inspect witch one is the correct, and, in fact, the HTTP_X_FORWARDED_FOR worked fine for me!

[Iomm1]

Just to add to OP's suggestion, create a page on your web site, eg IP.aspx and put this above

[Iomm1]

...[contd] the OP's code <%@ Page Language="C#" %> Underneath the OP's closing %> add <head runat="server"> <title></title> </head> <body> <form id="form1" runat="server"> <div> </div> </form> </body> </html> then call the IP.aspx page, it will display the various request headers. If any of them give you the answer you want, then that's the one to use. In my env, it was HTTP_CLIENT_IP