kompassi
kompassi copied to clipboard
When submitting survey responses, get real client IP address from next.js backend
https://github.com/con2/kompassi/blob/8e15401d09389603679bf0935443d2e970aebe92/backend/forms/graphql/mutations/create_survey_response.py#L36 https://github.com/con2/kompassi/blob/d7409aeb46c6ca8bd3c66593e29e546a0e3b3c2a/frontend/src/app/%5Blocale%5D/events/%5BeventSlug%5D/surveys/%5BsurveySlug%5D/actions.ts
The survey is submitted via a server action, so the network client that performs the mutation is the Next.js backend, not the user's browser. Therefore Response.ip_address
records the IP address of the Next.js backend, not that of the user.
We don't want just anyone to be able to spoof the IP address in Response, so we may need to add M2M authentication, wrap the IP address in a JWT or similar.
Either way this may prove too much work for such a minor use case, so another option is to remove the Response.ip_address
field altogether. However, we may have other use cases as well in the future in which we would like to record the IP address of the user, and the IP address is only visible to the kompassi2 next.js backend.
See discussion in Slack. Note that direct v1 use cases get the IP addresses right, so this is specific to v2 forms.Response
, and event_log.Entry
when it is created via v2 frontend.