I am attempting to use
auth0-forwarded-for header to pass the end user’s IP address from our backend to Auth0 in a ROPG flow.
I’m using the next link: Avoid Common Issues with Resource Owner Password Flow and Attack Protection to send end user IP to auth0.
I have tested sending
auth0-forwarded-for any value but the logs don’t show the value sent. I’ve checked
client_ip attributes in the log and both are the same.
Auth0 will ignore the auth0-forwarded header for unauthenticated clients (e.g. SPAs or Native apps that are unable to provide a client secret), and if the client has not been configured to explicitly trust the header.
In order for the tenant logs and anomaly detection to use the IP address passed in the
auth0-forwarded-for header in a Resource Owner Password flow, the client ID being used for authentication must be both:
- Using a Token Endpoint Authentication Method that is NOT “none”
- Have “Trust Token Endpoint IP Header” enabled in Advanced Settings > OAuth
Otherwise the header will be ignored and the actual IP used to make the call to
/oauth/token will be logged and used for anomaly detection purposes.