Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

stack: the gateway sets no X-Forwarded-For or X-Real-IP, so Edge Functions cannot see the client IP

未关闭 适合新手
  • 哪里不对？
#7,275 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
72/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
typescript
领域
backend

调研方向

阅读 packages/stack/src/HttpProxy.ts，尤其是 upstreamHeadersFor 以及访问日志中对 request.socket.remoteAddress 的使用。使用报告中提到的原生 stack 命令和 hello 函数复现，然后检查该函数是否收到包含客户端地址的两个转发标头，与旧版 stack 的行为一致。

由索引模型根据 Issue 内容生成。

描述

🐛 Bug supabase/cli
Affected area

Local development

Supabase CLI version

2.121.0

Operating system

macOS 27.0.1 (Apple silicon)

Installation method

pnpm

Command
SUPABASE_EXPERIMENTAL_STACK=1 supabase start --runtime native
for i in 1 2 3 4 5; do curl -s -w '  %{time_total}s\n' http://127.0.0.1:54321/functions/v1/hello; done
Actual output
{"requests":1,"workerStartedAt":"2026-10-22T04:47:49.507Z","xForwardedFor":null,"xRealIp":null}  1.111719s
{"requests":1,"workerStartedAt":"2026-10-22T04:47:49.553Z","xForwardedFor":null,"xRealIp":null}  0.023354s
{"requests":1,"workerStartedAt":"2026-10-22T04:47:49.586Z","xForwardedFor":null,"xRealIp":null}  0.018719s

# same project on the legacy stack (SUPABASE_EXPERIMENTAL_STACK=0 supabase start)
{"requests":1,"workerStartedAt":"2026-10-22T04:48:40.137Z","xForwardedFor":"192.168.171.1","xRealIp":"192.168.171.1"}  0.056585s
{"requests":2,"workerStartedAt":"2026-10-22T04:48:40.137Z","xForwardedFor":"192.168.171.1","xRealIp":"192.168.171.1"}  0.004061s
{"requests":3,"workerStartedAt":"2026-10-22T04:48:40.137Z","xForwardedFor":"192.168.171.1","xRealIp":"192.168.171.1"}  0.003451s

On the experimental stack the function gets neither X-Forwarded-For nor X-Real-IP. On the legacy stack Kong sets both to the client address.

Expected behavior

The experimental stack's gateway adds the client address as X-Forwarded-For and X-Real-IP, like Kong does on the legacy stack, so functions see who is calling them.

Steps to reproduce
  1. mkdir repro && cd repro && supabase init
  2. Create supabase/functions/hello/index.ts: 
    let requests = 0;
const workerStartedAt = new Date().toISOString();

Deno.serve((req) =>
  Response.json({
    requests: ++requests,
    workerStartedAt,
    xForwardedFor: req.headers.get("x-forwarded-for"),
    xRealIp: req.headers.get("x-real-ip"),
  })
);
  3. Add to supabase/config.toml: 
    [functions.hello]
verify_jwt = false
  4. SUPABASE_EXPERIMENTAL_STACK=1 supabase start --runtime native, then call the function as above. Both header fields are null.
  5. Stop it, start the legacy stack with SUPABASE_EXPERIMENTAL_STACK=0 supabase start (I passed -x for everything except the database, Kong and the edge runtime) and make the same call. Both fields hold the client address.

(The requests counter is for #7274 and doesn't matter here.)

Crash report ID

No response

Docker and service versions
Docker: Client 29.8.2, Server 29.8.2 (linux/arm64)

supabase/postgres       17.11.0.004
supabase/gotrue         v2.197.0
postgrest/postgrest     v16.4
supabase/realtime       v2.143.4
supabase/storage-api    v1.82.1
supabase/edge-runtime   v1.77.4
supabase/studio         2026.10.12-sha-3699278
supabase/postgres-meta  v0.100.0
supabase/logflare       1.53.0
supabase/supavisor      2.9.13
Additional context

In the v2.121.0 tag (97531eb590ccd2c5cf215287ae03e877180810b4), packages/stack/src/HttpProxy.ts builds the upstream headers in upstreamHeadersFor (lines 132-148). It copies the client's headers, drops hop-by-hop ones and rewrites host and the API key, but adds no forwarding headers. The client address is already there: the access log reads request.socket.remoteAddress (line 156). develop and next have no forwarding headers in that file either.

Our functions rate-limit by client IP, taken from the first X-Forwarded-For hop, and answer 400 when there is none. So on the native runtime every one of those functions fails locally, while the same project works on the legacy stack. Sending X-Forwarded-For from the client gets past it, because the gateway passes client headers through, but that means changing every caller just for local development.

I investigated this with help from an AI coding assistant (Claude Code), which also drafted this text. The results above come from real runs.

主要语言
TypeScript
星标
2.4k
派生
537
平均合并
19 小时 40 分钟
30 天内合并 PR
403

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

supabase/cli 的其他 Issue

查看 supabase/cli 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。