IP Contained in "auth0-forwarded-for" Not Shown in Logs
Last Updated:
Overview
This article explains why the value of the auth0-forwarded-for header is not being captured in Auth0 dashboard logs after it was configured to be sent during Resource Owner Password Grant (ROPG) Authentication flows using this example in the Auth0 Document Avoid Common Issues with Resource Owner Password Flow and Attack Protection guide.
Applies To
- Resource Owner Password Flow (ROPG)
auth0-forwarded-forheader
Cause
Auth0 will ignore the auth0-forwarded-for header for unauthenticated clients (e.g., SPAs or Native apps that are unable to provide a client secret) or if the client has not been configured to explicitly trust the header.
Solution
For the tenant logs and anomaly detection to use the IP address passed in the auth0-forwarded-for header in a Resource Owner Password flow, the client ID is used for the authentication must be both:
- Using a Token Endpoint Authentication Method that is NOT "none"
- Have "Trust Token Endpoint IP Header" enabled in Advanced Settings > OAuth
Otherwise, the header will be ignored, and the actual IP used to make the call to "/oauth/token" will be logged and used for anomaly detection.
