Cloud Code Trigger `request.ip` no longer returns the client IP, but rather server instance IP

[mman]

New Issue Checklist

• I am not disclosing a vulnerability.
• I am not just asking a question.
• I have searched through existing issues.
• I can reproduce the issue with the latest version of Parse Server.

Issue Description

I rely on request.ip in my cloud code triggers to determine what IP address is making the request. In the past request.ip always included the original client IP address no matter how many reverse proxies or load balancers are present in front of the parse-server itself. Recently, since one of the alpha releases, request.ip returns the IP of the machine on which the parse server instance is running.

Steps to reproduce

Parse.Cloud.afterLogin(async request => {
  console.log(request.ip);
});

Actual Outcome

Since recent alpha releases request.ip returns IP address of the machine where parse server is running, instead of the client's IP.

Expected Outcome

I assume for ease of use, I'd be interested in request.ip giving me back the original IP that made the request. I can examine the complete request path by looking at request.headers["x-forwarded-for"]. But request.ip should be IMHO the original client.

Workaround

I can for the moment workaround the issue by looking at the first item in request.headers["x-forwarded-for"].

const forwarded = request.headers["x-forwarded-for"] || request.ip;
const ip = forwarded.split(",", 1)[0];

Environment

Server

• Parse Server version: alpha
• Operating system: Linux

[parse-github-assistant]

Thanks for opening this issue!

• 🚀 You can help us to fix this issue faster by opening a pull request with a failing test. See our Contribution Guide for how to make a pull request, or read our New Contributor's Guide if this is your first time contributing.

[dblythy]

The mechanism to determine the client IP address has been rewritten; to correctly determine the IP address it is now required to set the Parse Server option trustProxy accordingly if Parse Server runs behind a proxy server, see the express framework's trust proxy setting

[mtrezza]

Closing, if setting the correct trust proxy settings doesn't work, please comment and we'll reopen.

[mman]

@dblythy Thanks for the hint. I can confirm that the following fix makes the request.ip work again:

var app = express();
app.set('trust proxy', true);

[mtrezza]

Thanks for reporting back

[ckarmy]

@dblythy Thanks for the hint. I can confirm that the following fix makes the request.ip work again:

var app = express();
app.set('trust proxy', true);

I implement this but I dont get request.ip... I need to add anything more than app.set('trust proxy', true); in my index.js?

[mtrezza]

@ckarmy What do you get as request.ip? And how do you make the request? I can see that you posted in the forum that the issue was resolved by setting

export const app = express();
app.set('trust proxy', true);

But that is also what you quoted in the comment where you said it did not work.