Opened 3 weeks ago

Closed 3 weeks ago

#37107 closed Uncategorized (invalid)

Request META key `REMOTE_ADDR` not set anywhere in wsgi applications

Reported by: Rami Boutassghount Owned by:
Component: Core (Other) Version: 6.0
Severity: Normal Keywords: REMOTE_ADDR, WSGIRequest, HttpRequest, META
Cc: Triage Stage: Unreviewed
Has patch: no Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no

Description

The docs suggest that the `REMOTE_ADDR? is the IP address of the client. See: https://docs.djangoproject.com/en/6.0/ref/request-response/#django.http.HttpRequest.META

However I searched all over the django codebase and that key is not set anywhere in HttpRequest or in its subclass WSGIRequest.

The only place where that key is set is in asgi module: https://github.com/django/django/blob/3e4e0db66961a48a080ff3ff91f6c0d954261366/django/core/handlers/asgi.py#L80

I run a small experiment to see what is the value on my test environment and it is always empty, see:

    def get_ip_address(self, request) -> str:
        meta = request.META
        remote_addr = meta.get("REMOTE_ADDR", "")
        x_forwarded_for = meta.get("HTTP_X_FORWARDED_FOR", "")
        x_real_ip = meta.get("HTTP_X_REAL_IP", "")
        Bot.to_admin(
            f"IP Address: \n"
            f"HTTP_X_FORWARDED_FOR: {x_forwarded_for}\n"
            f"REMOTE_ADDR: {remote_addr}\n"
            f"HTTP_X_REAL_IP: {x_real_ip}\n"
        )

Chat in Telegram:

[5/19/26 10:21 AM] Rami Bot: IP Address: 
HTTP_X_FORWARDED_FOR: 198.244.242.58
REMOTE_ADDR: 
HTTP_X_REAL_IP: 198.244.242.58
[5/19/26 10:21 AM] Rami Bot: IP Address: 
HTTP_X_FORWARDED_FOR: 2a03:2880:f814:19::
REMOTE_ADDR: 
HTTP_X_REAL_IP: 2a03:2880:f814:19::
[5/19/26 10:21 AM] Rami Bot: IP Address: 
HTTP_X_FORWARDED_FOR: 198.244.183.201
REMOTE_ADDR: 
HTTP_X_REAL_IP: 198.244.183.201
[5/19/26 10:22 AM] Rami Bot: IP Address: 
HTTP_X_FORWARDED_FOR: 5.39.1.228
REMOTE_ADDR: 
HTTP_X_REAL_IP: 5.39.1.228
[5/19/26 10:22 AM] Rami Bot: IP Address: 
HTTP_X_FORWARDED_FOR: 66.249.77.71
REMOTE_ADDR: 
HTTP_X_REAL_IP: 66.249.77.71
[5/19/26 10:22 AM] Rami Bot: IP Address: 
HTTP_X_FORWARDED_FOR: 2606:65c0:20:43d:a16b:57fd:233b:4fe6
REMOTE_ADDR: 
HTTP_X_REAL_IP: 2606:65c0:20:43d:a16b:57fd:233b:4fe6

Change History (2)

comment:1 by Richard Autry, 3 weeks ago

It's unlikely that REMOTE_ADDR would be used if your application sits behind a reverse proxy (i.e. nginx), and HTTP_X_FORWARDED_FOR would be the actual header you want to use.

REMOTE_ADDR is a server var and only useful if there is a direct (TCP) connection. This is not a Django bug or mistake in the docs.

See https://docs.oracle.com/html/E10726_01/c06_core_ref200.htm

comment:2 by Sarah Boyce, 3 weeks ago

Resolution: invalid
Status: newclosed

As Richard explained 👍

Note that this report seems better suited to be a support request. The best place to get answers when wanting support in future is using any of the user support channels from this link.

Note: See TracTickets for help on using tickets.
Back to Top