Getting true client IP address using C# in ASP.NET MVC - c#

I have an ASP.NET MVC web app and I need to get the client IP address.
I researched this and there are two main possibilities:
to retrieve the IP using HTTP headers
to retrieve it using HttpContext.Request.UserHostAddress
The problem with the first method is that the IP can easily be spoofed.
The problem with the second method is that if the client is behind a proxy, it retrieves the client proxy - not the client's own IP.
(See here - this is the best resource I found in SO describing the above problem)
My question: how can I retrieve the client's IP address in a way that cannot be spoofed and to get his own IP address, not his proxy's IP - is it possible?

Related

Unable to get the real client IP address when requesting from load balancing server in .net core

I Am trying to get the real IP of the client. since we are having multiple load balancing sever i count get the real IP address. in .net core 2.2 c#?
This is my application flow
Client => Load balancing server => API server => some Internal API server (IP needed here).
I want to get the IP address which is passed by client. Is it possible to get my client IP address even if I have multiple API server call? or if I got all server IP address, then I can get my client IP address by top 1'st record.
Note: The duplicated answers didn't help me.

How to get the Local IP of an ASP.net site when each site running on IIS is assigned its own IP?

I have 2 asp.net websites running on IIS with each has its own IP assigned to it. During the processing of one aspx page on let's say site 1, I make an HttpWebRequest to another aspx page by using HttpContext.Current.Request.Url.AbsoluteUri and replacing the page with the desired page. I get a socket exception. During my research, I realized that cisco doesn't let http request to be generated for internal resource by using my external IP address. I need to replace host name in HttpContext.Current.Request.Url.AbsoluteUri with the local ip address assigned to site 1. I don't want to hard code local ip address. Is there a way to get the local address that the site binds to using C#?
If you use the "local address" (perhaps the NETBIOS name or some internal server FQDN) your SSL cert won't match and you'll get an error.
The best thing you can do is go onto the box that is running IIS and add a hosts entry so that your site's external FQDN will resolve to 127.0.0.1. This will bypass DNS, bypass the network, and still work with the site's SSL certificate.
^ Assumes you are not using a particular type of SSL offloading (re-encryption with secondary cert).

calling a route with specific ip address

For the project I'm working on, I need to directly call the IP address of a computer within our C# environment. We are using asp.net / mvc 3 and the customer facing website has a controller that will expose an endpoint to hit from within the admin area of the site. This controller action will then call another private internal ip address that actually does the ground work. Basically there are two machines, one is customer facing, and the other machine is more for setup.
<private_ip_address>/admin/do_something_private
Does C# have a direct way to call an IP address like this?
As long as the PCs can see each other you can always establish a communication between them via HTTP. Just make sure you know how the endpoint is configured and what kind of "requests" it understands. Yet, the client must be aware of any security implementation on the server side in order to successfully authenticate the request. That's as abstract as I can get provided that your question is way too abstract
Your internal machine will have an external IP address. You'll need to point your external
L website to the external IP address of your modem/router and use your modem/router to route the request to the internal IP address. You can also put your internal machine on your router's DMZ but that's usually a bad idea.

MVC4 Web Api Client IP

i'm looking for a way to get the client ip address inside controller. I've tried HttpContext.Current.Request.UserHostAddress. This returns me ::1. Right now the Webserver is running on localhost and the requst is from localhost, too. Will this method work after deploying ?
Yes it will work.Now it is returing localhost in IP 6 format.
There are only a few things you should remember about:
If user is behind NAT or proxy it will show IP of NAT/proxy
There is a discussion about more problems with wrong IP UserHostAddress gives wrong IPs

Sending Local IP address of connection associated with HttpWebrequest (C#)

I am developing an application which has one web server and one C# client which posts XML to the web server. The web server needs to know the local IP address of client. I tried methods to retrieve the IP address at the server side, but these methods don't give the IP address of the client when there are proxy servers or NAT in between. So I need to find the local IP of the connection at the client application and send it with the request.
The problem is in HttpWebRequest. I don't see any method by which I can get the local IP address of the connection made while sending HTTP request.
CLARIFICATION:
The client in my case is not browser-based. It is a C# application. My server has specific rules based on local IP, that was are used to connect to the server while sending the HTTP request. In my case, local IPs are fixed. There could be multiple IPs on a local machine -- that's why I want the local IP associated with the Socket used to send the request. This can be solved if I use TcpClient in C# and implement the HTTP protocol on top of it, but I want to avoid that. So, is there any way I can get the socket associated with HttpWebRequest before posting the request?
It is not possible to get the local IPAddress of the connection that HttpWebRequest is going to use. However, you could use Dns or System.Net.NetworkInformation class to get all the local IPaddresses, and send them as a custom header with your request. On the server side you could parse this header, and see if any of the IP's match the one that you are expecting.
However, as Damien has indicated above, this solution is not foolproof, people could spoof the IPaddress to the one the server is expecting. Maybe you need to take a step back and think what security you are trying to achive by this? And see if you could accomplish your goals by a different method - for eg: user Authentication using a supported method like Basic(over HTTPS), Digest, NTLM, Kerberos, Negotiate, or use SSL with client certs?
One possible solution is to tell the client what ip it should use when connecting to the server, and include that ip in a custom header for the server to read.
var srcip = IPAddress.Parse("10.0.0.1");
var request = (HttpWebRequest)HttpWebRequest.Create ("http://example.com/");
request.Headers.Add("X-Original-Client-IP", srcip.ToString());
request.ServicePoint.BindIPEndPointDelegate = delegate { return new IPEndPoint(srcip, 0); };
request.GetResponse();
There's no guaranteed way of doing this. Javascript and server-side code can only see the public address, not the local one. There is a method for getting it using Java (mentioned here), but it relies on both Javascript and Java being available, and the user's browser supporting that particular call.
Given that many local IPs are assigned as needed (my home PC's is assigned using DHCP, my work PC's changes occasonally too), do you think knowing the local IP would actually be any use?
Maybe you should move from HttpWebRequest to SOAP requests/responses if XML is what you send over the line. Implement ASPX web service or WFC webservice. HttpWebRequest are always seen to the server as they are coming from the last IP that issued them so that would be NAT or proxy.
However, I too find it odd enough that you need to know local machine IP on the server side.

Categories

Resources