Can req.ip be faked in Express.js?

Question

I am trying to implement some anti-spamming mechanism into my server. I need to know whether req.ip can be faked by the remote hacker in Express.js. Could someone please confirm this with me?

Answer 1

Yes, it can be faked. request.ip getting it's value from the left most entry of the X-Forwarded-For header, which can be faked.

Express docs: https://expressjs.com/en/api.html#req.ip