req.ip and req.hostname in Express - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does req.ip represent in Express?

req.ip gives you the IP address of the client making the request. It helps you know where the request came from.

beginner

What is the purpose of req.hostname in Express?

req.hostname returns the domain name or host from the request URL. It tells you which website or server the client is trying to reach.

intermediate

How does Express determine req.ip when behind a proxy?

Express looks at the X-Forwarded-For header if trust proxy is enabled. This helps get the real client IP even if the request passes through proxies.

beginner

Is req.hostname affected by the port number in the URL?

No, req.hostname only returns the host name without the port number. For example, from http://example.com:3000, it returns example.com.

intermediate

Why is it important to set app.set('trust proxy', true) when using req.ip behind proxies?

Without trusting the proxy, req.ip might show the proxy's IP instead of the real client IP. Setting trust proxy tells Express to use the correct client IP from headers.

What does req.ip return in Express?

A The client's IP address

B The server's IP address

C The hostname of the request

D The port number of the request

req.ip gives the IP address of the client making the request.

Which header does Express check to get the real client IP when trust proxy is enabled?

A Host

B X-Forwarded-For

C User-Agent

D Content-Type

The X-Forwarded-For header contains the original client IP when behind proxies.

What does req.hostname return?

A The client's IP address

B The full URL including protocol

C The port number

D The domain name from the request URL

req.hostname returns the domain or host part of the URL.

Does req.hostname include the port number if present in the URL?

A No, it excludes the port number

B Yes, always

C Only if the port is 80

D Only if the port is 443

req.hostname excludes the port number from the host.

Why should you set app.set('trust proxy', true) when using req.ip behind a proxy?

A To block proxy requests

B To disable IP logging

C To get the real client IP instead of the proxy IP

D To enable HTTPS

Setting trust proxy lets Express trust proxy headers and get the real client IP.

Explain how req.ip works in Express and how proxies affect it.

Think about how Express finds the client IP when behind other servers.

Describe what req.hostname returns and how it differs from the full URL.

Focus on the host part of the URL only.

Practice

1. What does req.ip represent in an Express app?

easy

A. The visitor's IP address

B. The domain name used in the request

C. The server's IP address

D. The HTTP method of the request

Solution

1. Step 1: Understand the purpose of req.ip

   req.ip provides the IP address of the client making the request.

2. Step 2: Differentiate from req.hostname

   req.hostname gives the domain name, not the IP address.

3. Final Answer:

   The visitor's IP address -> Option A

4. Quick Check:

   req.ip = visitor's IP [OK]

Hint: Remember: IP is address, hostname is domain name [OK]

Common Mistakes:

• Confusing req.ip with req.hostname
• Thinking req.ip is server IP
• Assuming req.ip gives HTTP method

2. Which of the following is the correct way to access the hostname in an Express route handler?

easy

A. req.host

B. req.domain

C. req.hostname

D. req.hostName

Solution

1. Step 1: Recall Express request object properties

   The correct property for the domain name is req.hostname.

2. Step 2: Check other options for validity

   req.host, req.domain, and req.hostName are not valid Express properties.

3. Final Answer:

   req.hostname -> Option C

4. Quick Check:

   Hostname property = req.hostname [OK]

Hint: Hostname is all lowercase: req.hostname [OK]

Common Mistakes:

• Using req.host instead of req.hostname
• Capitalizing property names incorrectly
• Assuming req.domain exists

3. Consider this Express route handler: <pre>app.get('/', (req, res) => { res.send(`IP: ${req.ip}, Hostname: ${req.hostname}`); }); If a user visits http://example.com from IP 192.168.1.5, what will be the response text?

medium

A. IP: undefined, Hostname: example.com

B. IP: example.com, Hostname: 192.168.1.5

C. IP: 127.0.0.1, Hostname: localhost

D. IP: 192.168.1.5, Hostname: example.com

Solution

1. Step 1: Identify req.ip and req.hostname values

   req.ip gives the visitor's IP, which is 192.168.1.5. req.hostname gives the domain, which is example.com.

2. Step 2: Substitute values into the response string

   The response string becomes: IP: 192.168.1.5, Hostname: example.com.

3. Final Answer:

   IP: 192.168.1.5, Hostname: example.com -> Option D

4. Quick Check:

   IP and hostname match request info [OK]

Hint: Match IP to visitor, hostname to domain in response [OK]

Common Mistakes:

• Swapping IP and hostname values
• Assuming localhost IP instead of visitor IP
• Using undefined or wrong properties

4. You wrote this Express middleware: <pre>app.use((req, res, next) => { console.log(req.ipAddress); next(); }); What is the problem with this code?

medium

A. Middleware must be declared after routes

B. req.ipAddress is not a valid property; should use req.ip

C. Logging should be done with res.ip instead

D. Missing call to next() to continue middleware chain

Solution

1. Step 1: Check property names on req

   req.ipAddress does not exist in Express; the correct property is req.ip.

2. Step 2: Verify middleware correctness

   The middleware calls next(), so chain continues correctly.

3. Final Answer:

   req.ipAddress is not a valid property; should use req.ip -> Option B

4. Quick Check:

   Use req.ip for IP address [OK]

Hint: Use exact property names: IP is req.ip [OK]

Common Mistakes:

• Using req.ipAddress instead of req.ip
• Forgetting to call next()
• Trying to log IP from res object

5. You want to restrict access to your Express app only to requests coming from the domain trusted.com. Which code snippet correctly uses req.hostname to allow this?

hard

A. app.use((req, res, next) => { if (req.hostname === 'trusted.com') next(); else res.status(403).send('Forbidden'); });

B. app.use((req, res, next) => { if (req.ip === 'trusted.com') next(); else res.status(403).send('Forbidden'); });

C. app.use((req, res, next) => { if (req.host === 'trusted.com') next(); else res.status(403).send('Forbidden'); });

D. app.use((req, res, next) => { if (req.hostname.includes('trusted.com')) next(); else res.status(403).send('Forbidden'); });

Solution

1. Step 1: Use req.hostname to check exact domain

   app.use((req, res, next) => { if (req.hostname === 'trusted.com') next(); else res.status(403).send('Forbidden'); }); correctly compares req.hostname to the string 'trusted.com'.

2. Step 2: Evaluate other options for correctness

   app.use((req, res, next) => { if (req.ip === 'trusted.com') next(); else res.status(403).send('Forbidden'); }); wrongly compares req.ip to a domain string. app.use((req, res, next) => { if (req.host === 'trusted.com') next(); else res.status(403).send('Forbidden'); }); uses invalid req.host. app.use((req, res, next) => { if (req.hostname.includes('trusted.com')) next(); else res.status(403).send('Forbidden'); }); uses includes which may allow subdomains, not exact match.

3. Final Answer:

   Option A code snippet -> Option A

4. Quick Check:

   Exact match with req.hostname = app.use((req, res, next) => { if (req.hostname === 'trusted.com') next(); else res.status(403).send('Forbidden'); }); [OK]

Hint: Check exact domain with req.hostname === 'domain' [OK]

Common Mistakes:

• Comparing IP to domain string
• Using invalid property req.host
• Using partial match instead of exact domain