Description
The @cap-js/attachments plugin extracts the client IP address for security event audit logging using req.req?.socket?.remoteAddress (https://github.com/cap-js/attachments/blob/main/lib/generic-handlers.js). On BTP Cloud Foundry (and any reverse-proxy deployment), this returns the internal IP of the Go Router or Approuter — not the actual client IP.
This affects all three security events:
AttachmentSizeExceededAttachmentUploadRejectedAttachmentDownloadRejected
Current behavior
// lib/generic-handlers.js (3 occurrences)
const ipAddress = req.req?.socket?.remoteAddress
On CF, socket.remoteAddress resolves to the internal container/proxy IP (e.g., 10.x.x.x), making the logged IP useless for security forensics.
Expected behavior
The plugin should read X-Forwarded-For with fallback to socket.remoteAddress, consistent with how the Approuter extracts the client IP for audit logging:
// @sap/approuter — lib/utils/logger.js:76
let IP = req.headers['x-forwarded-for'] || req.connection.remoteAddress;
Context
- On BTP Cloud Foundry, the request chain is:
Client → Go Router → Approuter → Backend. The Go Router sets X-Forwarded-For with the real client IP.
@cap-js/audit-logging does not extract IP itself — it relies on the caller to provide the ip field, so the fix belongs in @cap-js/attachments.
Description
The
@cap-js/attachmentsplugin extracts the client IP address for security event audit logging usingreq.req?.socket?.remoteAddress(https://github.com/cap-js/attachments/blob/main/lib/generic-handlers.js). On BTP Cloud Foundry (and any reverse-proxy deployment), this returns the internal IP of the Go Router or Approuter — not the actual client IP.This affects all three security events:
AttachmentSizeExceededAttachmentUploadRejectedAttachmentDownloadRejectedCurrent behavior
On CF,
socket.remoteAddressresolves to the internal container/proxy IP (e.g.,10.x.x.x), making the logged IP useless for security forensics.Expected behavior
The plugin should read
X-Forwarded-Forwith fallback tosocket.remoteAddress, consistent with how the Approuter extracts the client IP for audit logging:Context
Client→Go Router→Approuter→Backend. TheGo RoutersetsX-Forwarded-Forwith the real client IP.@cap-js/audit-loggingdoes not extract IP itself — it relies on the caller to provide theipfield, so the fix belongs in@cap-js/attachments.