AspNetCoreVisitorInfo 1.0.5

AspNetCoreVisitorInfo

HttpContext extension methods that read the visitor's IP, country, and city from the proxy/CDN headers that Cloudflare, CloudFront, App Engine, Azure, and common reverse proxies set.

Examples

string ipAddress = httpContext.GetVisitorIp();
string country = httpContext.GetVisitorCountry();
string city = httpContext.GetVisitorCity();

Each method walks an ordered list of headers, most specific first, and returns the first usable value. GetVisitorIp() falls back to HttpContext.Connection.RemoteIpAddress; all three return an empty string when nothing matches.

GetVisitorIp() returns a single parsed address: the left-most entry of an X-Forwarded-For list, the for= parameter of an RFC 7239 Forwarded header, and the address without the port from CloudFront-Viewer-Address. A header that is absent, empty, or not a valid IP address is skipped and the next header in the chain is used.

Security: these headers are not trustworthy by default

Every value returned by these methods comes from a request header the caller controls. Anyone who can reach your application can send CF-Connecting-IP: 1.2.3.4 or CF-IPCountry: US and this library will return it — it has no way to know which proxy, if any, is actually in front of you.

These values are safe to trust only if both of the following hold:

1. Your application is not reachable directly — every request arrives through a proxy you control.
2. That proxy overwrites the header on ingress rather than appending to a client-supplied value.

If you cannot say yes to both, do not use these values for authorization, rate limiting, ban lists, audit logs, fraud checks, or geo-gating. Use HttpContext.Connection.RemoteIpAddress, configured with ASP.NET Core's ForwardedHeadersMiddleware and its KnownProxies / KnownNetworks allow-list, which validates the peer before honouring a header. Analytics and other non-security uses are what this library is for.

Narrowing the chain

The default chain is ordered by convention, not by trust: it tries CF-Connecting-IP first whether or not you are behind Cloudflare. If you know which header your proxy sets, pass it explicitly so the others cannot be used to spoof the value:

// Behind Cloudflare: trust only the header Cloudflare overwrites, ignore everything else.
string ipAddress = httpContext.GetVisitorIp("CF-Connecting-IP");
string country = httpContext.GetVisitorCountry("CF-IPCountry");

Passing an empty array skips the headers entirely and uses the connection's remote IP address.