Capture request originating IP address in OIC

Recently, we encountered a business use case where requests passed through proxies or load balancers and reaches to HCM. At one layer, requests were being blocked, preventing users from logging into HCM. For debugging, the customer requested information on the originating IP address, along with intermediary IP addresses, to diagnose the issue. The ‘X-Forwarded-For’ header is one of the properties that can be utilized for debugging purposes.

The X-Forwarded-For (XFF) is an HTTP header field that is used to identify the originating IP address of a client, especially when a request passes through one or more intermediary proxies or load balancers.

Here’s how it typically works:

1. Client Sends Request: A client (e.g., a web browser) sends an HTTP request to a web server.
2. Request Passes Through Proxies or Load Balancers: If the request passes through one or more proxies or load balancers, each intermediary server may append the client’s IP address to the X-Forwarded-For header.
3. X-Forwarded-For Header: The X-Forwarded-For header then contains a comma-separated list of IP addresses, where the first IP address is the original client's IP, and subsequent addresses are the IP addresses of the intermediaries.
4. Web Server Accesses X-Forwarded-For Header: The web server, upon receiving the request, can check the X-Forwarded-For header to determine the original client's IP address.

The primary use cases for X-Forwarded-For include:

• Logging and Analysis: Web servers can log the client’s original IP address for analysis and logging purposes. This is especially important in scenarios where traffic passes through proxies or load balancers.
• Security: Some applications use the X-Forwarded-For header to implement security measures. For example, it might be used to allow or deny access based on the client's IP address.

It’s important to note that the X-Forwarded-For header can be easily manipulated. Additionally, when using this header, be aware of privacy considerations and potential security risks.

OIC Implementation

Create an App-Driven integration , drag an REST Connection (trigger)

Select custom Request headers

Request Headers, add Custom Header Name X-Forwarded-For

Print the X-Forwarded-For using logger

Logger will print X-Forwarded-For: Client IP, Proxy1, Proxy2

You can also check other Custom Header like 

X-Forwarded-Port : Gives the port the client connected to on the proxy (e.g. 80 or 443)

X-Forwarded-Proto : Gives the protocol the client used to connect to the proxy (http or https)

X-Forwarded-Host : Gives the content of the Host header the client sent to the proxy