Get IP address IN Keycloak

Author: Tusharmahajan12

src/auth/auth.service.ts

@@ -26,10 +26,38 @@ export class AuthService {
     private readonly keycloakService: KeycloakService
   ) {}
 
+  private getClientIpForKeycloak(request: Request): string | undefined {
+    const ipFromExpress = normalizeIpForForwarding(request?.ip);
+    if (ipFromExpress) return ipFromExpress;
+
+    // Fallback: only trust X-Forwarded-For if the direct connection is internal (proxy hop).
+    const remoteAddress = normalizeIpForForwarding(request?.socket?.remoteAddress);
+    const isInternal =
+      !!remoteAddress &&
+      (remoteAddress === '127.0.0.1' ||
+        remoteAddress === '::1' ||
+        remoteAddress.startsWith('10.') ||
+        remoteAddress.startsWith('192.168.') ||
+        (remoteAddress.startsWith('172.') &&
+          (() => {
+            const second = parseInt(remoteAddress.slice(4, 7), 10);
+            return second >= 16 && second <= 31;
+          })()));
+
+    if (!isInternal) return undefined;
+
+    const xff = request?.headers?.['x-forwarded-for'];
+    const raw =
+      typeof xff === 'string' ? xff : Array.isArray(xff) ? xff.join(',') : undefined;
+    if (!raw) return undefined;
+    const first = raw.split(',')[0]?.trim();
+    return normalizeIpForForwarding(first);
+  }
+
   async login(request: Request, authDto, response: Response) {
     const apiId = APIID.LOGIN;
     const { username, password } = authDto;
-    const clientIp = normalizeIpForForwarding(request?.ip);
+    const clientIp = this.getClientIpForKeycloak(request);
 
     try {
       // Optimized: Only check user status (no tenant/role data needed for login)
@@ -126,7 +154,7 @@ export class AuthService {
     response: Response
   ): Promise<LoginResponse> {
     const apiId = APIID.REFRESH;
-    const clientIp = normalizeIpForForwarding(request?.ip);
+    const clientIp = this.getClientIpForKeycloak(request);
     const { access_token, expires_in, refresh_token, refresh_expires_in } =
       await this.keycloakService.refreshToken(refreshToken, clientIp).catch(() => {
         throw new UnauthorizedException();
@@ -149,7 +177,7 @@ export class AuthService {
 
   async logout(request: Request, refreshToken: string, response: Response) {
     const apiId = APIID.LOGOUT;
-    const clientIp = normalizeIpForForwarding(request?.ip);
+    const clientIp = this.getClientIpForKeycloak(request);
     try {
       const logout = await this.keycloakService.logout(refreshToken, clientIp);
       return APIResponse.success(