Auth0-forwarded-for IP not shown in logs

FAQs
,
1

Problem statement

I am attempting to use auth0-forwarded-for header to pass the end user’s IP address from our backend to Auth0 in a ROPG flow.

I’m using the next link: Avoid Common Issues with Resource Owner Password Flow and Attack Protection to send end user IP to auth0.

I have tested sending auth0-forwarded-for any value but the logs don’t show the value sent. I’ve checked IP and client_ip attributes in the log and both are the same.

Cause

Auth0 will ignore the auth0-forwarded header for unauthenticated clients (e.g. SPAs or Native apps that are unable to provide a client secret), and if the client has not been configured to explicitly trust the header.

Solution

In order for the tenant logs and anomaly detection to use the IP address passed in the auth0-forwarded-for header in a Resource Owner Password flow, the client ID being used for authentication must be both:

  1. Using a Token Endpoint Authentication Method that is NOT “none”
  2. Have “Trust Token Endpoint IP Header” enabled in Advanced Settings > OAuth

Otherwise the header will be ignored and the actual IP used to make the call to /oauth/token will be logged and used for anomaly detection purposes.

2