C#•6mo ago

Capture clients IP address when they call my API

I am making an authentication API. I would like to log the IP address my client as part of my session system. I need a method of capturing the clients IP address that isn't passed in by the client. I've tried HttpContext, but that seems to be passed in by the client who i cant trust.

51 Replies

qqdev•6mo ago

Are you using ASP.NET?

hutoanhillOP•6mo ago

i think so? first c# api ive developed

Pobiega•6mo ago

HttpContext.Connection.RemoteIpAddress iirc

qqdev•6mo ago

Yeah, something like that You can trust that info btw The client shouldn't be able to fake that

Angius•6mo ago

Just be careful about whether the IP is classified as PII in your jurisdiction or not Also, it won't work when using a proxy like Cloudflare, all requests will just have CF's IP You'd have to read the actual IP from X-Forwarded-For header

Buddy•6mo ago

PII = Personally Identifiable Information

hutoanhillOP•6mo ago

i was testing out the API (using the swagger API) and the request header has a place where i could pass in any IP i wanted. Is that jus a swagger thing?

qqdev•6mo ago

What is the name of that header?

hutoanhillOP•6mo ago

request body? or POST?

qqdev•6mo ago

Those are different things You can send headers as a part of an HTTP request/response POST is an HTTP verb. Other HTTP verbs: GET, POST, PUT, DELETE, PATCH, OPTIONS

hutoanhillOP•6mo ago

when I have HttpContext as a paramiter of my login endpoint i see all the elements of the HttpContext here and it allows me to edit them:

qqdev•6mo ago

No IP tho, right? Wait

Pobiega•6mo ago

Uh.. don't put the context as a parameter

hutoanhillOP•6mo ago

let me add the HttpContext back and i will show you

qqdev•6mo ago

You can access it directly It's within the scope

Pobiega•6mo ago

What type.of API is it? Controller or minimal API? Bro

qqdev•6mo ago

:pepelaff:

Angius•6mo ago

Let me emphasize: do NOT request HttpContext as a parameter

qqdev•6mo ago

Angius•6mo ago

Unless it's with the [FromServices] attribute or w/e

hutoanhillOP•6mo ago

ok, than how do i get it. do i just access it directly?

Angius•6mo ago

Pobiega•6mo ago

Minimal API or controllers?

Angius•6mo ago

The answer will depend on your answer

hutoanhillOP•6mo ago

i dont know the diferance :/

Pobiega•6mo ago

Look at your code

qqdev•6mo ago

Or show us your code

Pobiega•6mo ago

Show us an API endpoint The code for one

hutoanhillOP•6mo ago

private static async Task<LoginResponce> LoginHandler(Login request) {
        string username = request.username;
        string password = request.password;
        string twoFACode = request.twoFAResponce;
        //HttpContext context = request.HttpContext;
...
}

...
 WebApplicationBuilder builder = WebApplication.CreateBuilder(args);
app.UseHttpsRedirection();
        
app.MapPost("/login", LoginHandler)
  .WithName("Login")
  .WithDescription("Returns an auth key you can use to access the database.");

app.Run();

private static async Task<LoginResponce> LoginHandler(Login request) {
        string username = request.username;
        string password = request.password;
        string twoFACode = request.twoFAResponce;
        //HttpContext context = request.HttpContext;
...
}

...
 WebApplicationBuilder builder = WebApplication.CreateBuilder(args);
app.UseHttpsRedirection();
        
app.MapPost("/login", LoginHandler)
  .WithName("Login")
  .WithDescription("Returns an auth key you can use to access the database.");

app.Run();

Angius•6mo ago

Minimal APIs then

Pobiega•6mo ago

That's minimal So the context should be decorated with [FromServices] and be the first thing you request And it needs to be in the handler signaturee Not on your request object

hutoanhillOP•6mo ago

whats my context? the Login record?

Pobiega•6mo ago

No that is your request object Don't put http context in your request object, put it in your endpoint handler signature I'm on phone ATM so can't show you

hutoanhillOP•6mo ago

like this?

[FromServices]
    private static async Task<LoginResponce> LoginHandler(Login request, [FromServices] HttpContext context) {

[FromServices]
    private static async Task<LoginResponce> LoginHandler(Login request, [FromServices] HttpContext context) {

Angius•6mo ago

hutoanhillOP•6mo ago

epic! Yes, the service i am building deals with alot of that, so its somthing we are concerned with. hm. i think i am missing somthing abour decorations...

Attribute 'Microsoft.AspNetCore.Mvc.FromServicesAttribute' is not valid on this declaration type. It is valid on 'Property, Parameter' declarations only.

Attribute 'Microsoft.AspNetCore.Mvc.FromServicesAttribute' is not valid on this declaration type. It is valid on 'Property, Parameter' declarations only.

Angius•6mo ago

Ah, you have another [FromServices] on the method I see That's not where it goes, remove it

hutoanhillOP•6mo ago

[FromServices]
    private static async Task<LoginResponce> LoginHandler(Login request, HttpContext context) {

[FromServices]
    private static async Task<LoginResponce> LoginHandler(Login request, HttpContext context) {

the error persists

Pobiega•6mo ago

You can probably safely remove the attribute Err That attribute is placed on your method... Not on the parameter

Angius•6mo ago

Remove it from the method Keep it on the parameter

hutoanhillOP•6mo ago

ah like this:

private static async Task<LoginResponce> LoginHandler(Login request, [FromServices] HttpContext context) {

private static async Task<LoginResponce> LoginHandler(Login request, [FromServices] HttpContext context) {

Angius•6mo ago

Yes

Pobiega•6mo ago

Yes

Angius•6mo ago

As the error says, this attribute is only valid on props and params

hutoanhillOP•6mo ago

that would do it. missread 'on' as 'as' ok. new error. says i have to register a servace for HttpContext which makes since.. but i dont know what service or how.

Angius•6mo ago

Huh Try... removing the [FromServices]...? Just a wild guess

Pobiega•6mo ago

also.. dont it have to be before the payload object? maybe that has changed

Angius•6mo ago

¯\_(ツ)_/¯

Pobiega•6mo ago

(I don't use minimal APIs directly these days :D)

Angius•6mo ago

Neither do I

hutoanhillOP•6mo ago

GPT suggested adding builder.Services.AddHttpContextAccessor();, then using IHttpContexAccessor to get the context and it looks like thats working cuz now i am getting a SQL error Thanks for your help!

Gaming

Programming

Capture clients IP address when they call my API