TsgcWebSocketFirewall › Methods › ResolveClientIP
Returns the real client address for a request received through a trusted reverse proxy, or the peer address unchanged when the forwarded headers cannot be trusted.
function ResolveClientIP(const aPeerIP: string; aHeaders: TStrings): string;| Name | Type | Description |
|---|---|---|
aPeerIP | const string | Address of the socket that opened the connection, which behind a proxy is the proxy itself. |
aHeaders | TStrings | Raw request headers. X-Forwarded-For and X-Real-IP are read from this list according to ForwardedHeaders.Mode. May be nil. |
The resolved client address, or aPeerIP unchanged when the feature is disabled, the peer is not a trusted proxy, no usable header is present, the X-Forwarded-For chain holds fewer entries than TrustedHops, or the candidate value does not parse as an IP address. (string)
This overload extracts the two header values from the supplied list and forwards them to the second overload, so both share the same rules. It is the form the servers call internally, once per request.
vClientIP := sgcWebSocketFirewall1.ResolveClientIP(Connection.PeerIP,
Connection.HeadersRequest);function ResolveClientIP(const aPeerIP, aXForwardedFor, aXRealIP: string): string;| Name | Type | Description |
|---|---|---|
aPeerIP | const string | Address of the socket that opened the connection, which behind a proxy is the proxy itself. |
aXForwardedFor | const string | Full X-Forwarded-For header value, a comma separated chain. Pass an empty string when the header is absent. |
aXRealIP | const string | X-Real-IP header value. Pass an empty string when the header is absent. |
The resolved client address, or aPeerIP unchanged when the headers cannot be trusted or produce no usable address. (string)
The method first applies the trust gate: ForwardedHeaders.Enabled must be True and aPeerIP must match an entry in TrustedProxies, matched with the same IP and CIDR rules used by the blacklist. An empty TrustedProxies list means no header is ever honoured, so a client cannot forge its own address. A candidate is then taken according to Mode: X-Real-IP first when the mode allows it, otherwise the X-Forwarded-For chain, where every proxy appends the address of the peer it received the request from, so the last TrustedHops entries come from the trusted proxies and the first of those is the client address, while anything further left was written by the client itself and is never taken. A chain that holds fewer entries than TrustedHops does not match the declared topology, so nothing in it is trusted and aPeerIP is returned unchanged. Brackets, an IPv6 zone identifier and a trailing port are stripped and the value is normalized. A candidate that does not parse as IPv4 or IPv6 is discarded and the peer address is returned instead, so a malformed header can never produce a value that matches no rule. The method only computes an address; it applies no policy of its own, use IsForwardedIPAllowed for the verdict.
// with TrustedHops of 1 the last entry, appended by the proxy, is the client
vClientIP := sgcWebSocketFirewall1.ResolveClientIP('10.0.0.5',
'198.51.100.4, 203.0.113.7', '');
if not sgcWebSocketFirewall1.IsForwardedIPAllowed(vClientIP) then
Connection.Disconnect;