Why req.ip and req.hostname in Express? - Purpose & Use Cases

The Big Idea

Discover how Express saves you from messy network detective work with just two simple properties!

The Scenario

Imagine building a web server that needs to know where requests come from and which website address was used, but you try to track this by manually parsing raw request data.

The Problem

Manually extracting IP addresses and hostnames from request headers is tricky, error-prone, and can break easily when proxies or different network setups are involved.

The Solution

Express provides req.ip and req.hostname properties that automatically and reliably give you the client IP and the hostname used, handling common network quirks for you.

Before vs After

✗ Before

const ip = req.headers['x-forwarded-for'] || req.connection.remoteAddress;
const host = req.headers.host.split(':')[0];

✓ After

const ip = req.ip;
const host = req.hostname;

What It Enables

This lets you easily customize responses, log user info, or apply security rules based on client IP and hostname without messy code.

Real Life Example

For example, a website can block suspicious IPs or serve different content depending on the domain name the user typed, all by using req.ip and req.hostname.

Key Takeaways

Manually parsing IP and hostname is complex and unreliable.

req.ip and req.hostname simplify access to this info.

They help build smarter, safer web apps with less code.

Practice

1. What does req.ip represent in an Express app?

easy

A. The visitor's IP address

B. The domain name used in the request

C. The server's IP address

D. The HTTP method of the request

Solution

1. Step 1: Understand the purpose of req.ip

   req.ip provides the IP address of the client making the request.

2. Step 2: Differentiate from req.hostname

   req.hostname gives the domain name, not the IP address.

3. Final Answer:

   The visitor's IP address -> Option A

4. Quick Check:

   req.ip = visitor's IP [OK]

Hint: Remember: IP is address, hostname is domain name [OK]

Common Mistakes:

• Confusing req.ip with req.hostname
• Thinking req.ip is server IP
• Assuming req.ip gives HTTP method

2. Which of the following is the correct way to access the hostname in an Express route handler?

easy

A. req.host

B. req.domain

C. req.hostname

D. req.hostName

Solution

1. Step 1: Recall Express request object properties

   The correct property for the domain name is req.hostname.

2. Step 2: Check other options for validity

   req.host, req.domain, and req.hostName are not valid Express properties.

3. Final Answer:

   req.hostname -> Option C

4. Quick Check:

   Hostname property = req.hostname [OK]

Hint: Hostname is all lowercase: req.hostname [OK]

Common Mistakes:

• Using req.host instead of req.hostname
• Capitalizing property names incorrectly
• Assuming req.domain exists

3. Consider this Express route handler: <pre>app.get('/', (req, res) => { res.send(`IP: ${req.ip}, Hostname: ${req.hostname}`); }); If a user visits http://example.com from IP 192.168.1.5, what will be the response text?

medium

A. IP: undefined, Hostname: example.com

B. IP: example.com, Hostname: 192.168.1.5

C. IP: 127.0.0.1, Hostname: localhost

D. IP: 192.168.1.5, Hostname: example.com

Solution

1. Step 1: Identify req.ip and req.hostname values

   req.ip gives the visitor's IP, which is 192.168.1.5. req.hostname gives the domain, which is example.com.

2. Step 2: Substitute values into the response string

   The response string becomes: IP: 192.168.1.5, Hostname: example.com.

3. Final Answer:

   IP: 192.168.1.5, Hostname: example.com -> Option D

4. Quick Check:

   IP and hostname match request info [OK]

Hint: Match IP to visitor, hostname to domain in response [OK]

Common Mistakes:

• Swapping IP and hostname values
• Assuming localhost IP instead of visitor IP
• Using undefined or wrong properties

4. You wrote this Express middleware: <pre>app.use((req, res, next) => { console.log(req.ipAddress); next(); }); What is the problem with this code?

medium

A. Middleware must be declared after routes

B. req.ipAddress is not a valid property; should use req.ip

C. Logging should be done with res.ip instead

D. Missing call to next() to continue middleware chain

Solution

1. Step 1: Check property names on req

   req.ipAddress does not exist in Express; the correct property is req.ip.

2. Step 2: Verify middleware correctness

   The middleware calls next(), so chain continues correctly.

3. Final Answer:

   req.ipAddress is not a valid property; should use req.ip -> Option B

4. Quick Check:

   Use req.ip for IP address [OK]

Hint: Use exact property names: IP is req.ip [OK]

Common Mistakes:

• Using req.ipAddress instead of req.ip
• Forgetting to call next()
• Trying to log IP from res object

5. You want to restrict access to your Express app only to requests coming from the domain trusted.com. Which code snippet correctly uses req.hostname to allow this?

hard

A. app.use((req, res, next) => { if (req.hostname === 'trusted.com') next(); else res.status(403).send('Forbidden'); });

B. app.use((req, res, next) => { if (req.ip === 'trusted.com') next(); else res.status(403).send('Forbidden'); });

C. app.use((req, res, next) => { if (req.host === 'trusted.com') next(); else res.status(403).send('Forbidden'); });

D. app.use((req, res, next) => { if (req.hostname.includes('trusted.com')) next(); else res.status(403).send('Forbidden'); });

Solution

1. Step 1: Use req.hostname to check exact domain

   app.use((req, res, next) => { if (req.hostname === 'trusted.com') next(); else res.status(403).send('Forbidden'); }); correctly compares req.hostname to the string 'trusted.com'.

2. Step 2: Evaluate other options for correctness

   app.use((req, res, next) => { if (req.ip === 'trusted.com') next(); else res.status(403).send('Forbidden'); }); wrongly compares req.ip to a domain string. app.use((req, res, next) => { if (req.host === 'trusted.com') next(); else res.status(403).send('Forbidden'); }); uses invalid req.host. app.use((req, res, next) => { if (req.hostname.includes('trusted.com')) next(); else res.status(403).send('Forbidden'); }); uses includes which may allow subdomains, not exact match.

3. Final Answer:

   Option A code snippet -> Option A

4. Quick Check:

   Exact match with req.hostname = app.use((req, res, next) => { if (req.hostname === 'trusted.com') next(); else res.status(403).send('Forbidden'); }); [OK]

Hint: Check exact domain with req.hostname === 'domain' [OK]

Common Mistakes:

• Comparing IP to domain string
• Using invalid property req.host
• Using partial match instead of exact domain