I need to get the users IP address on the server. For technical reasons it's a lot easier for me to just pass it in from the client in the form of a query string.

So, on page load I would store their IP address in a JavaScript variable. Then when it comes time to call the server I'll send it back.

I can imagine if someone was using TOR or a VPN they might not want their IP address to be included in the URL of an AJAX. But my users don't have extreme security concerns like someone who his using TOR. Still, I don't know if it's bad practice to store their IP in JavaScript and then pass it to the server as part of a query string.

  • How are you getting the IP address? Are you sure that what you're doing will bypass Tor, VPN, and proxies? Is it important that the IP address be correct? If you're just storing it in a variable, it is easy for the end-user to spoof it. Aug 1, 2016 at 21:19
  • use hash (/#secret) instead of search (/?secret) to keep it out of http logs and sniffers... From a JS point of view, they are identically simple, but hash doesn't go over the wire.
    – dandavis
    Aug 1, 2016 at 21:49
  • The real problem is if your server trusts the browser to not send an invalid/spoofed/fake IP address...
    – Jedi
    Aug 2, 2016 at 1:47
  • How do you actually get their IP address? Do you want the one they're using to connect to you or the one configured on their local machine?
    – pjc50
    Aug 2, 2016 at 10:03

2 Answers 2


This is like asking can you safely store someones mailing address inside a postcard from/to the person.

No, this isn't a security concern unless the user is using something like TOR and even then its not the end of the world because it will be the exit nodes IP.


Depending on what you use it for it could be security concern. If you use the IP address to identify the user then one user could change that part of the query string and impersonate a different user.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .