@arcjet/ip

Arcjet utilities for finding the originating IP of a request.

• npm package (@arcjet/ip)
• GitHub source code (ip/ in arcjet/arcjet-js)

What is this?

This is an internal utility to help us deal with IP addresses. It includes code from the Rust standard library code to parse IPv4 and IPv6 and also contains some code from pbojinov/request-ip. We turned the Rust IP parser into TypeScript so that we have the exact same functionality in both languages. Similar functionality in alternative JavaScript libraries often uses regular expressions but those can cause ReDoS attacks. We sidestep that problem because the Rust IP parser algorithm does not use regular expressions. We chose to copy code from request-ip so that we only keep the functionality that we use and keep our dependency tree as light as possible. Our code is different: if we know we are running on Cloudflare for example then we do not trust headers typically set by fly.io.

When should I use this?

You should not use this but use one of the alternatives instead. This package matches our current needs which are likely different from yours.

Install

This package is ESM only. Install with npm in Node.js:

npm install @arcjet/ip

Example

import findIp from "@arcjet/ip";

const ip = findIp({ headers: { "x-real-ip": "1.1.1.1" } });
console.log(ip); // => "1.1.1.1"

Considerations

The IP should not be trusted as it can be spoofed in most cases, especially when loaded via the Headers object. We apply additional platform guards if a platform is supplied in the options argument.

If a private/internal address is encountered, it will be skipped. If only those are detected, an empty string is returned.

License

Apache License, Version 2.0 © Arcjet Labs, Inc.

Derivative work based on Parser in std::net, is_global on Ipv4Addr, and is_global on Ipv6Addr from rust-lang/rust, dual licensed under MIT and Apache-2.0 © contributors. Our work ports to TypeScript so that we have the same functionality in both languages.

Derivative work based on getClientIp from request-ip licensed under MIT © Petar Bojinov. Our work cherry picks only what we need.