API source IP limitation fails - strange mix v4 and v6

[HachimanSec]

Hi everyone,
in 4.2.7 I created an API token.
I limited the token to a source IP (my laptop for testing purpose).
Therefore I entered 172.16.0.42/32 in the dialog.

When I test it from said laptop, I get a authZ error:

curl -k -H "Authorization: Token 1234" \
-H "Accept: application/json; indent=4" \
https://10.0.2.10/api/dcim/sites/
{
    "detail": "Source IP ::ffff:172.16.0.42 is not permitted to authenticate using this token."
}%

It looks like it mixes some ipv6 with ipv4?
I dont use any ipv6 internally:

en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
	options=6460<TSO4,TSO6,CHANNEL_IO,PARTIAL_CSUM,ZEROINVERT_CSUM>
	ether af:af:fe:af:fe:7d
	inet 172.16.0.42 netmask 0xffffff00 broadcast 172.16.0.255
	media: autoselect
	status: active

[HachimanSec]

Apparently ipv6 is the way to go - i might have missed it in the docs.
Configuring ::ffff:172.16.0.0/112 works now.

[markkuleinio]

It is a v4mapped IPv6 address.

Look at your reverse proxy (Apache or Nginx) configuration, changing the listen configuration should change the address reporting I think.

[HachimanSec]

Kitos @markkuleinio. Using the mapped addresses works as well too. But looking at the ngnix deployment is a good hint.