[#282] added the "real" user ip to the logs

apis/logs.go

@@ -28,7 +28,7 @@ type logsApi struct {
 var requestFilterFields = []string{
 	"rowid", "id", "created", "updated",
 	"url", "method", "status", "auth",
-	"ip", "referer", "userAgent",
+	"remoteIp", "userIp", "referer", "userAgent",
 }
 
 func (api *logsApi) requestsList(c echo.Context) error {

apis/middlewares.go

@@ -252,7 +252,8 @@ func ActivityLogger(app core.App) echo.MiddlewareFunc {
 				Method:    strings.ToLower(httpRequest.Method),
 				Status:    status,
 				Auth:      requestAuth,
-				Ip:        httpRequest.RemoteAddr,
+				UserIp:    realUserIp(httpRequest),
+				RemoteIp:  httpRequest.RemoteAddr,
 				Referer:   httpRequest.Referer(),
 				UserAgent: httpRequest.UserAgent(),
 				Meta:      meta,
@@ -297,3 +298,23 @@ func ActivityLogger(app core.App) echo.MiddlewareFunc {
 		}
 	}
 }
+
+// Returns the "real" user IP from common proxy headers
+// (fallback to [r.RemoteAddr]).
+//
+// The returned IP shouldn't be trusted if not behind a trusted reverse proxy!
+func realUserIp(r *http.Request) string {
+	ipHeaders := []string{
+		"CF-Connecting-IP",
+		"X-Forwarded-For",
+		"X-Real-Ip",
+	}
+
+	for _, header := range ipHeaders {
+		if ip := r.Header.Get(header); ip != "" {
+			return ip
+		}
+	}
+
+	return r.RemoteAddr
+}