How do I detect the client IP on Firebase?

How do I detect the client IP on Firebase?

Read the platform header Firebase sets after its own proxy, and only after you know the process is running on Firebase. The Arcjet SDK does that for you: it sees a non-empty FIREBASE_CONFIG, treats the request as Firebase, and uses x-fah-client-ip instead of guessing from X-Forwarded-For.

You do not download Google's published IP list. You do not populate proxies with Firebase or Cloud Run CIDRs. Those lists drift. Platform detection is the v1 path.

1
import arcjet, { slidingWindow } from "@arcjet/next";
2

3
const aj = arcjet({
4
  key: process.env.ARCJET_KEY!,
5
  // No proxies entry. FIREBASE_CONFIG selects the Firebase header.
6
  rules: [slidingWindow({ mode: "LIVE", interval: 60, max: 60 })],
7
});
8

9
export async function POST(req: Request) {
10
  const decision = await aj.protect(req);
11
  if (decision.isDenied()) {
12
    return Response.json({ error: "Denied" }, { status: 429 });
13
  }
14
  // Your handler
15
}

The Go SDK does not read FIREBASE_CONFIG, so name the platform on the client instead. That is the same decision, made explicitly:

1
aj, err := arcjet.NewClient(arcjet.Config{
2
  Platform: arcjet.PlatformFirebase,
3
  Rules: []arcjet.Rule{
4
    arcjet.SlidingWindow(arcjet.SlidingWindowOptions{
5
      Mode:        arcjet.ModeLive,
6
      Interval:    time.Minute,
7
      MaxRequests: 60,
8
    }),
9
  },
10
})

Platform also accepts PlatformFlyIo, PlatformVercel, PlatformRender, PlatformRailway, and PlatformCloudflare. Set it whenever the environment variables a platform normally exposes are absent, which is the usual case for a Go service behind a CDN. The Go SDK is pre-release; pin an exact version.

Rate limits, bot rules, and Shield are only as good as the identity they key on. On Firebase the identity before login is the real client IP. Getting that IP wrong means one attacker shares a budget with a whole region, or bypasses the budget by spoofing X-Forwarded-For. The same platform-header pattern is how Fly exposes Fly-Client-IP; see deploy an Arcjet-protected app to Fly.io.

Why can't I trust X-Forwarded-For on Firebase?

Every hop in front of your function can append to X-Forwarded-For. The client can also send the header already populated. MDN's rule is: trust only the suffix that your proxies added. Firebase App Hosting puts a CDN, load balancers, and Cloud Run in that chain. The two proxy addresses Arcjet observed in testing changed without notice.

If you take the left-most IP, you take whatever the client wrote. If you take the right-most IP, you often get a Google or Fastly hop, not the browser. Neither is a stable client identity.

proxies in v1 still works the way it did in earlier SDKs. You pass IPs or CIDRs. Arcjet walks X-Forwarded-For from the right and skips addresses you listed.

1
const aj = arcjet({
2
  key: process.env.ARCJET_KEY!,
3
  rules: [],
4
  proxies: [
5
    "203.0.113.100", // One hop you control
6
    "203.0.113.0/24", // A range you control
7
  ],
8
});

Use proxies for a load balancer you run. Do not use it as your Firebase strategy. You would be chasing Google's published ranges.

Should I maintain a static list of Google proxy IPs?

No, not as the primary mechanism. Google publishes ranges at https://www.gstatic.com/ipranges/goog.json and cloud.json. Those files change as Google adds and retires prefixes. A serverless function that fetches them on every cold start adds latency and a dependency on gstatic.com. A list bundled in the SDK is stale the day after Google publishes a new prefix, and it is only current if you upgrade the package.

The proxies option remains the right tool for your reverse proxy. It is the wrong tool for a CDN whose ranges Google updates without paging you.

How does platform detection work?

Arcjet looks at environment variables the host sets. A non-empty FIREBASE_CONFIG means Firebase. FLY_APP_NAME means Fly. VERCEL means Vercel. RENDER means Render. You do not set these in .env.local. If you copy FIREBASE_CONFIG into a laptop env file, you would trust x-fah-client-ip on traffic that never passed Firebase.

The header is only safe after that check. Anyone can send x-fah-client-ip: 1.2.3.4. Without platform confirmation that value is attacker-controlled.

You can also force the lookup with @arcjet/ip if you need the address outside protect():

1
import ip from "@arcjet/ip";
2

3
export function clientIpFor(request: Request) {
4
  return ip(request, { platform: "firebase" });
5
}

The main SDK already does this when it detects Firebase. You need the explicit platform option only when the env var is missing (unusual on Firebase) or when you call @arcjet/ip yourself.

How do Firebase App Hosting and Cloud Functions differ?

Both can set FIREBASE_CONFIG. Both sit behind Google infrastructure. The hop count and the header you can trust are not the same.

App Hosting is the Next.js-shaped product (framework-aware builds, CDN, Cloud Run). Functions is still the right place for background HTTP and event handlers. Install @arcjet/next or @arcjet/node in either. Call protect() in the handler. For algorithm choice once the IP is correct, use the rate limiting guide.

If a dashboard decision shows a Google IP or an empty IP, the SDK did not detect Firebase or the header was absent. Check FIREBASE_CONFIG in the function environment (Firebase console or firebase functions:secrets:access is the wrong tool; print Boolean(process.env.FIREBASE_CONFIG) from a debug route you remove before production). Do not invent a proxies list to paper over a missed detection.