How to send the client ip address in forward_auth?

1. Caddy version (caddy version):

v2.5.1 h1:bAWwslD1jNeCzDa+jDCNwb8M3UJ2tPa8UZFFzPVmGKs=

2. How I run Caddy:

a. System environment:

Ubuntu 20
Not using docker
Not using kubernetes

b. Command:

sudo systemctl start caddy

c. Service/unit/compose file:


d. My complete Caddyfile or JSON config:

(auth) {
	forward_auth :9000 {
		uri {path}?remote_ip={remote_addr}
        header_up X-Forwarded-Ip {remote_addr}
		copy_headers Remote-Ip Remote-Addr Remote-User Remote-Groups Remote-Name Remote-Email X-Real-IP

3. The problem I’m having:

I want to access the inbound client ip address in the auth server that is responding to forward_auth but all I see in the headers of the inbound auth request is and when I try to write in the ip address in a rewrite it say ‘nil’

{'host': 'editorapi.videopcom', 'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ Safari/537.36', 'accept': '*/*', 'accept-encoding': 'gzip, deflate, br', 'accept-language': 'en-GB,en-US;q=0.9,en;q=0.8', 'content-type': 'application/json', 'origin': '', 'referer': '', 'sec-ch-ua': '" Not A;Brand";v="99", "Chromium";v="102", "Google Chrome";v="102"', 'sec-ch-ua-mobile': '?0', 'sec-ch-ua-platform': '"macOS"', 'sec-fetch-dest': 'empty', 'sec-fetch-mode': 'cors', 'sec-fetch-site': 'same-site', 'x-forwarded-foo': '', 'x-forwarded-for': '', 'x-forwarded-host': '', 'x-forwarded-method': 'GET', 'x-forwarded-proto': 'http', 'x-forwarded-uri': '/paintbox/my-team/test'}

4. Error messages and/or full log output:


5. What I already tried:

I’d tried many variations of headers and header names and copying headers and including on the path but nothing.


6. Links to relevant resources:

1 Like

Why do you need this? It’s already passed correctly and safely via the X-Forwarded-For header.

Anyways, the valid Caddyfile placeholder shortcuts are listed here:

1 Like

x-forwarded-for contains

Yep, which is the remote address.

Hmmm. OK I must be not understanding something.

When a request comes in, I want to first do a subrequest to my auth server, which based on avalable information about the request (header values/cookies/client ip address) I can then send back a 200 to wave it through the the destination server, or something else to block the request.

I would have thought the auth server would get the client IP address as part of this process. What am I misunderstanding?

1 Like

That’s correct.

What do you see in Caddy’s logs? What’s your entire Caddyfile? Turn on the debug global option and the log directive to see all the logs.

Do you have some other proxy in front of Caddy that might be intercepting the requests, making it look like they’re coming from

1 Like

You are correct. Following the information you provided I researched further and found a second server redirect which was causing the IP address field to be set to locahost.

I am very impressed and thank you kindly for your level of help.


This topic was automatically closed after 30 days. New replies are no longer allowed.