Check signup IPs in Express middleware

1import { isIP } from 'node:net';
2​
3const ENDPOINT = 'https://YOUR_API_HOST/v1/ip';
4const REMEMBER_MS = 60 * 60 * 1000;
5const MAX_ENTRIES = 5000;
6const remembered = new Map();
7​
8// The last element is the one your own proxy appended. Earlier ones may come from the client.
9export function forwardedFor(header) {
10  if (!header) return null;
11  const elements = header.split(',');
12  const match = /(?:^|;)\s*for=("?)([^;"]+)\1/i.exec(elements[elements.length - 1]);
13  if (!match) return null;
14  let node = match[2];
15  if (node.startsWith('[')) node = node.slice(1, node.indexOf(']'));
16  else if (node.includes(':')) node = node.slice(0, node.indexOf(':'));
17  return isIP(node) ? node : null;
18}
19​
20function remember(ip, value) {
21  if (remembered.size >= MAX_ENTRIES) remembered.delete(remembered.keys().next().value);
22  remembered.set(ip, { value, until: Date.now() + REMEMBER_MS });
23}
24​
25export function ipCheck({ apiKey, timeoutMs = 800, trustForwarded = false }) {
26  return async function ipCheckMiddleware(req, res, next) {
27    const ip = (trustForwarded ? forwardedFor(req.headers.forwarded) : null) ?? req.ip;
28    req.ipCheck = { ip, status: 'skipped' };
29    if (!ip) return next();
30​
31    const hit = remembered.get(ip);
32    if (hit && hit.until > Date.now()) {
33      req.ipCheck = hit.value;
34      return next();
35    }
36    try {
37      const response = await fetch(ENDPOINT, {
38        method: 'POST',
39        headers: { Authorization: `Bearer ${apiKey}`, 'Content-Type': 'application/json' },
40        body: JSON.stringify({ ip }),
41        signal: AbortSignal.timeout(timeoutMs),
42      });
43      if (response.status === 200) {
44        const body = await response.json();
45        const data = body.data ?? {};
46        req.ipCheck = {
47          ip,
48          status: body.found ? 'found' : 'not_found',
49          country: data.country ?? null,
50          isHosting: data.is_hosting ?? null,
51          riskScore: data.risk_score ?? null,
52        };
53        remember(ip, req.ipCheck);
54      } else if (response.status === 400) {
55        remember(ip, req.ipCheck); // a private or reserved address: skipped, and not worth asking again
56      } else {
57        req.ipCheck = { ip, status: 'error', http: response.status };
58      }
59    } catch {
60      req.ipCheck = { ip, status: 'error' };
61    }
62    next(); // always: the lookup informs the request, it never blocks it
63  };
64}

1import express from 'express';
2import { ipCheck } from './ip-check.js';
3​
4const app = express();
5app.set('trust proxy', 1); // one reverse proxy in front of this app
6​
7app.post('/signup', ipCheck({ apiKey: process.env.LOOKVALID_API_KEY }), (req, res) => {
8  const { status, isHosting, riskScore } = req.ipCheck;
9  const review = status === 'found' && (isHosting === true || riskScore >= 50);
10  // Save the account either way; send the flagged ones to your review queue.
11  res.status(201).json({ ok: true, review });
12});