Express req.ips Property
What you’ll learn
- What values appear in
req.ips. - Why
trust proxyis required for forwarded chains. - How to inspect IP hops for diagnostics and auditing.
- How to avoid trusting unverified forwarding headers.
Usage syntax
javascript
req.ips1
Read full forwarded IP chain
javascript
app.set('trust proxy', true);
app.get('/chain', function (req, res) {
res.json({ ips: req.ips });
});2
Log selected client and proxy chain
javascript
app.set('trust proxy', true);
app.use(function (req, res, next) {
console.log('client:', req.ip, 'chain:', req.ips);
next();
});❓ FAQ
It is an array of IP addresses from the forwarded chain when trust proxy is enabled.
If trust proxy is disabled or no forwarding headers are present, req.ips is often empty.
req.ip gives one selected client IP, while req.ips gives the full forwarded chain.
It is typically parsed from X-Forwarded-For headers provided by proxies/load balancers.
No. Validate trust proxy configuration carefully to avoid spoofed header data.
Did you know?
req.ips contains the proxy/client address chain only when trust proxy is enabled; otherwise it is usually an empty array.
About the author
4 people found this page helpful