HttpProtectOptions.getClientIp property

Resolver used to extract the client IP address from an incoming request. By default request-ip's getClientIp() is used, which reads the usual proxy headers (x-forwarded-for, x-real-ip, etc.).

Because bans and rate limits are keyed by this address, blindly trusting forwarded headers lets a client spoof its IP. Override this with a trust-aware resolver (for example one built on top of the proxy-addr package, configured with your known proxies) when the service is exposed behind proxies you do not fully control.

Spoofing cuts both ways here, and the second direction is the worse one. A client that varies the header evades its own counter; a client that forges someone else's address spends that address's budget and can get it banned — permanently, per HttpProtectOptions.banLimit. So on an untrusted path this option is the difference between a rate limiter and a way to have arbitrary third parties blocked.

Signature:

getClientIp?: (req: Request) => string | null;

Read this page as plain markdown — no HTML, no navigation. For pasting into an LLM, or for an agent to fetch.