Make client IP address available for use in DB functions and/or RLS

[david-colombo]

I want to use the clients real public IP address (not the forwarded-for header) in either DB functions or RLS (preferred) to restrict certain DB actions (including SELECT) to certain public IP addresses (even for authenticated users).

[GaryAustin1]

What exact header are you looking for?
These are passed in:
"x-real-ip": "175.41.170.240"
"x-forwarded-for": "72.117.250.11, 175.41.170.240",
"cf-connecting-ip": "72.117.250.11",

And available with current_setting('request.headers', true)::json;

[david-colombo]

The x-* headers don’t work as they can easily be manipulated by the client sending the request, therefore untrustworthy for RLS in my opinion.

The CF header might work, do you know where it’s referenced in the docs? Didn’t see it anywhere until now, so thank you! I’ll try it.

[GaryAustin1]

No, I've not seen any of the headers referenced other than the function to get them. I have an rpc function that does what I showed above and returns it so I can see all the headers available.

The function is here: https://postgrest.org/en/stable/references/transactions.html?highlight=headers#request-headers-cookies-and-jwt-claims

[GaryAustin1]

I do not know if any http headers are secure as I think most can be faked. I'm not recommending them as a fool proof RLS solution, just showing the ones you can get.