I am trying to implement some anti-spamming mechanism into my server. I need to know whether req.ip can be faked by the remote hacker in Express.js. Could someone please confirm this with me?

I am trying to implement some anti-spamming mechanism into my server. I need to know whether req.ip can be faked by the remote hacker in Express.js. Could someone please confirm this with me?

• javascript
• node.js
• express
• ip
• spam-prevention

1 Answer 1

Yes, it can be faked. request.ip getting it's value from the left most entry of the X-Forwarded-For header, which can be faked.

Express docs: https://expressjs./en/api.html#req.ip