Determining a visitor's real IP address gets messy when your application sits behind a CDN. Relying blindly on the remote IP often means you are just logging the CDN's edge server instead of the actual client.
Here is how we handle client IP verification on Upsun:
The problem:
The remote IP belongs to the CDN, not the actual visitor. This breaks accurate logging and security auditing.
The fix:
Upsun inherently retains the real visitor IP behind platforms like Fastly, Cloudflare, and CloudFront using the X-Client-IP header. If you use a different CDN, you must set the header unconditionally and strictly verify who is talking to your servers.
Why it matters:
Establishing a clear chain of trust ensures your application logs accurate user data without exposing your infrastructure to header spoofing.
Check out the full technical write-up to see how to securely log real client IPs behind any CDN:
Can you trust the X-Client-IP header? - Upsun Developer
Why the X-Client-IP header on Upsun holds the real visitor IP behind Fastly, Cloudflare, and CloudFront, and how to log real client IPs behind any other CDN.
developer.upsun.com
Top comments (0)