Next.js api route with IP address

Question

Inside one of my next.js api route,

For example: pages/api/example.js

I have the following simple code. Then, inside this route, I have post request to a server.

export default async function example(req, res) {
   
  const data = await axios.post(
     https://another_server_Url, // another server api
    {
      data
    })

  res.status(200).json({ name: 'John Doe' })
}

My question is if the another_server api implement a rating-limiting mechanism, It's possible for me to get the user IP address first, then somehow pass the IP address via the axios request. So the another_server api can recognize the true ip.

As far as I understand the current code, the next.js server somehow becomes a proxy.

The problem now is that because I called the Api inside my next router api, the ip address will always be my next.js server.

83C10 · Accepted Answer · 2021-07-24T10:46:32.003

You may get client's IP from req.headers['x-forwarded-for'] - have a look at: How to determine a user's IP address in node. Then, pass this IP within axios POST request body to another_server.

Edit:

In response to your comment below the implementation largely depends on the configuration of the backend server (another_server) and how it reads the client IP. For example, check if it uses request headers to determine the IP - if so, identify the particular header and overwrite it in axios call to include original client IP, e.g:

  const clientIp = (req.headers['x-forwarded-for'] || '').split(',').pop().trim() || 
    req.socket.remoteAddress;

  const data = await axios({
    method: 'post',
    url: 'https://google.com',
    headers: {
      'x-forwarded-for': clientIp
    },
    // ...
  });

Another solution would be to simply send the request from the client side straight to another_server and skip the problem altogether, but I assume it's not a viable solution in your case.

your answer seems perfectly legit. But it assume another server will pick up ip in post body besides from header. So it mean the another server need to handle the ip differently in the rate limit middleware depending on the incoming ip address (get the ip field only if the ip in header is from next.js ip), in case if some malicious posts abuse the ip field at some point but we won't pick it up. Maybe this is the only hard way to go. My question is badly crafted because it hide the true issue I want to address. — Yunhai, Jul 24 '21 at 09:42

Next.js api route with IP address

1 Answers1