# HttpProtectOptions.getClientIp property · @imqueue/http-protect

Source: https://imqueue.org/api/http-protect/latest/http-protect.httpprotectoptions.getclientip/
Published: 2026-08-01
Author: @imqueue maintainers (https://github.com/imqueue)
Package: @imqueue/http-protect 3.0.1 — generated reference, not hand-written

Resolver used to extract the client IP address from an incoming request. By default request-ip's getClientIp() is used, which reads the usual proxy headers (x-forwarded-for, x-real-ip, etc.).

Because bans and rate limits are keyed by this address, blindly trusting forwarded headers lets a client spoof its IP. Override this with a trust-aware resolver (for example one built on top of the `proxy-addr` package, configured with your known proxies) when the service is exposed behind proxies you do not fully control.

Spoofing cuts both ways here, and the second direction is the worse one. A client that varies the header evades its own counter; a client that forges someone else's address spends that address's budget and can get it banned — permanently, per [HttpProtectOptions.banLimit](https://imqueue.org/api/http-protect/latest/http-protect.httpprotectoptions.banlimit/). So on an untrusted path this option is the difference between a rate limiter and a way to have arbitrary third parties blocked.

**Signature:**

```typescript
getClientIp?: (req: Request) => string | null;
```