I want to obtain the client/browser IP address to rate limit unauthenticated clients in my Google App Engine Standard/Go web app.
In the deployed app r.RemoteAddr returns the empty string.
Enumerating through the request headers (r.Header [string][]string) provides only the following entries.
Content-Length
X-Appengine-Citylatlong
X-Appengine-Region
Upgrade-Insecure-Requests
Accept-Language
X-Cloud-Trace-Context
X-Appengine-Country
X-Appengine-City
Host
Cache-Control
Origin
Content-Type
Referer
User-Agent
Accept
No IP addresses.
How do you obtain the client IP?
In Google App Engine r.RemoteAddr does in fact return the IP address (my bad). However despite other recommendations ip, _, err := net.SplitHostPort(r.RemoteAddr) actual returns the error:
address 2601:645:8101:7784:7112:5258:8ba3:c888: too many colons in address
and no IP address.
Do not use net.SplitHostPort and you'll get an IPv6 address.
I've logged an issue with Google.