fix getting ip address

server/handlers/helpers.handler.js

@@ -3,11 +3,6 @@ const { validationResult } = require("express-validator");
 const { CustomError } = require("../utils");
 const env = require("../env");
 
-function ip(req, res, next) {
-  req.realIP = req.headers["x-real-ip"] || req.connection.remoteAddress || "";
-  return next();
-};
-
 function error(error, req, res, _next) {
   if (!(error instanceof CustomError)) {
     console.error(error);
@@ -87,7 +82,6 @@ function parseQuery(req, res, next) {
 
 module.exports = {
   error,
-  ip,
   parseQuery,
   verify,
 }

server/handlers/links.handler.js

@@ -529,7 +529,7 @@ async function redirect(req, res, next) {
   if (link.user_id && !isBot) {
     queue.visit.add({
       userAgent: req.headers["user-agent"],
-      realIP: req.realIP,
+      ip: req.ip,
       referrer: req.get("Referrer"),
       link
     });
@@ -560,7 +560,7 @@ async function redirectProtected(req, res) {
   if (link.user_id) {
     queue.visit.add({
       userAgent: req.headers["user-agent"],
-      realIP: req.realIP,
+      ip: req.ip,
       referrer: req.get("Referrer"),
       link
     });

server/queues/visit.js

@@ -34,7 +34,7 @@ module.exports = function({ data }) {
     const [os = "Other"] = osList.filter(filterInOs(agent));
     const referrer =
     data.referrer && removeWww(URL.parse(data.referrer).hostname);
-    const location = geoip.lookup(data.realIP);
+    const location = geoip.lookup(data.ip);
     const country = location && location.country;
 
     

server/server.js

@@ -22,8 +22,11 @@ require("./passport");
 // create express app
 const app = express();
 
-// stating that this app is running behind a proxy
-// and the express app should get the IP address from the proxy server
+// this tells the express app that the app is running behind a proxy server
+// and thus it should get the IP address from the proxy server
+// IMPORTANT: users might be able to override their IP address and this
+// might allow users to bypass the rate limit or lead to incorrect link stats
+// read the Kutt documentation to learn how prevent users from changing their real IP address
 app.set("trust proxy", true);
 
 app.use(helmet({ contentSecurityPolicy: false }));
@@ -33,7 +36,6 @@ app.use(express.urlencoded({ extended: true }));
 app.use(express.static("static"));
 
 app.use(passport.initialize());
-app.use(helpers.ip);
 app.use(locals.isHTML);
 app.use(locals.config);