X_FORWARDED_FOR and X_REAL_IP header in application proxy no longer sending correct ip address

Highlighted
Excursionist
18 0 4

Starting today, a request to application proxy is no longer sending the correct IP address in the X_FORWARDED_FOR header or the X_REAL_IP header.  Until today these headers contained it IP of request to the shopify page.  As of today it seems these are containing shopify IP addresses.

 

These headers are still documented on https://help.shopify.com/en/api/guides/application-proxies

 

We had no notice of this change and it is causing a breaking change to our app.  How can we reliably get the requesting users ip address from the request through an application proxy page.

1 Like
Highlighted
Excursionist
18 0 4

Investigating the request it looks like I am now able to get the requesting user ip from the HTTP_CF_CONNECTING_IP header, however I need a way of getting this that does not change.  


Can someone from Shopify let us know a reliable unchanging way to get this information going forward?

1 Like
Highlighted
New Member
6 0 0

I'm having the same problem. HTTP_X_FORWARDED_FOR should have list of IP addresses. Now it has only 1 ip - that ip belongs to shopify.

I'm using app proxy, so I can't get user ip anymore.

0 Likes
Shopify Staff
Shopify Staff
152 19 15

Hey @James154 and @Corknine,

 

Thanks for reporting this issue, our developers just shipped a fix which restores the expected IP in these headers, so you should be seeing the expected values now. Please don't hesitate to reach out if there are any questions.

JB | Developer Support @ Shopify
 - Was my reply helpful? Click Like to let me know! 
 - Was your question answered? Click Accept as Solution 

0 Likes