Azure - Backend getting IP from Azure Front Door not from the source

Question

I have an App Services that gets user data (IP) for logs from who uses my app. I deployed the Azure front door and since then, my application is collecting the Azure Front Door IP instead of my clients' device IP.

How can I fix this without change my application?

Thank you!

Sobriquet

I guess your path will lead to configuring the X-Forwarded-For header. – Corpus

Answer 1

Azure Front Door retains the client IP address as part of documented headers.

In particular, your application would need to inspect and parse either X-Azure-ClientIP, X-Azure-SocketIP, or X-Forwarded-For headers depending on which best captures the source IP you're interested in.

Candycecandystriped

Thanks for the answer, we've noticed the problem and customers are complaining. We will fix it this week and let you know if there's a gotcha. – Akerboom

We have had some users that this doesn't seem to be correct. It is either giving an IpV6 address or not the address we would expect. – Thapsus

All of these are empty now. – Loathing

Answer 2

In 2024, Azure Front Door does not appear to provide the client IP address as perhaps it did in the 2021 answer.

To get it, use a Front Door Rule Set.

You may or may not need to change your code, depending on which Request header value your existing code relies on. In my code migration to Azure, the code was previously depending on CloudFlare's "CF-Connecting-IP" header. That meant for me now that I could set up a Front Door rule to add that header to incoming requests.

You can't change or overwrite some Azure headers, so you may even end up creating a new one in a rule set e.g. "RuleSet-Client-IP".

These instructions work for Azure Front Door Premium.

1. Navigate to your Front Door resource
2. Under Settings, click on Rule sets
3. Click Add rule
4. Make it similar to the first image below, with the header value being {client_ip}.
5. Save

After creating the new Rule Set, you need to connect it to at least one Front Door Route. This is done from the list of Rule Sets, clicking the three-dots menu at the end of the ClientIpRules line, and choosing Associate a route.

If your code needs changing to pick up the header name that you used, then change your code.

Loathing