Storing client's IP address in Firebase - firebase

Question

As far I know there is no information available from the browser to find out the client's IP address without making another call to another resource.
Is there a way to store a client's IP address? I mean in a similar way as the firebase.timestamp placeholder works.

Answer 1

Although I've heard that there are now ways for clients to determine and report their IP address, relying on client side code to report their IP address also opens up the ability for anyone to run custom client side code to report the wrong IP address.
The only secure way of keeping track of the clients' IP addresses would either involve you having a server, or Firebase having a special function, when called by the client, that causes firebase's server to grab the client's IP address and save it for you.
My recommendation would be to run a simple server that can take a POST request. The server only needs to be able to verify what user the request is coming from, and will be able to accurately grab the client's IP address and save it on firebase.

Answer 2

in the following URL
https://firebase.google.com/docs/auth/admin/manage-sessions
In section "Advanced Security: Enforce IP address restrictions"
you'll find a reference to the remoteIpAddress
in this piece of code (the row that the arrow points to):
app.post('/getRestrictedData', (req, res) => {
// Get the ID token passed.
const idToken = req.body.idToken;
// Verify the ID token, check if revoked and decode its payload.
admin.auth().verifyIdToken(idToken, true).then((claims) => {
// Get the user's previous IP addresses, previously saved.
return getPreviousUserIpAddresses(claims.sub);
}).then(previousIpAddresses => {
// Get the request IP address.
const requestIpAddress = req.connection.remoteAddress; <=============================
// Check if the request IP address origin is suspicious relative to previous
// IP addresses. The current request timestamp and the auth_time of the ID
// token can provide additional signals of abuse especially if the IP address
// suddenly changed. If there was a sudden location change in a
// short period of time, then it will give stronger signals of possible abuse.
if (!isValidIpAddress(previousIpAddresses, requestIpAddress)) {
// Invalid IP address, take action quickly and revoke all user's refresh tokens.
revokeUserTokens(claims.uid).then(() => {
res.status(401).send({error: 'Unauthorized access. Please login again!'});
}, error => {
res.status(401).send({error: 'Unauthorized access. Please login again!'});
});
} else {
// Access is valid. Try to return data.
getData(claims).then(data => {
res.end(JSON.stringify(data);
}, error => {
res.status(500).send({ error: 'Server error!' })
});
}
});
});