Viewing Client IP Addresses used in Remote Sessions
The ThingWorx Remote Access Client (RAC) logs the IP addresses of remote devices used to launch remote sessions. Accurate IP tracking is useful for both legal and security audits compliance. You can use this functionality to track of the IP addresses of users connecting to remote devices, even when the network includes an IP address translator, such as when layer load balancers or reverse proxies are used.
When starting RAC, it caches the client IP and then sends it to the RemoteSessions data table when the session begins. When the session ends, audit logs are updated with the client IP and the sessions details, maintaining a complete log for end-to-end tracking.
When a RAC user connects to ThingWorx using a proxy or load balancer, the proxy IP is logged instead of the client. To record the client IP, you must configure the connection server to read from the X-Forwarded-For header on all network layers. The IP address is logged in the clientIP column of the ThingWorx AuditDataTable entity, enabling you to log IPs accurately, even when using reverse proxies.
 |
When the round-trip time for IP updates exceeds one second, the IP is logged as unknown.
|
Viewing Session Information in ThingWorx
You can view session information with the client IP address on a ThingWorx server using the following steps.
1. In Composer, click > > , then open the AuditDataTable data table.
2. On the Services tab, open the GetDataTableEntries or the QueryDataTableEntries services.
3. Define inputs for the service, then click Execute.
The output shows a list of sessions and the RAC IP address is displayed under the clientIP column on the session complete entry.
Configuring Reverse Proxies to forward the Client IP Address
The X-Forwarded-For (XFF) header is an HTTP header that you can use to send the client IP address in when using a reverse proxy. When a proxy is configured to add this header, the ThingWorx server can log and process the original client IP. For example:
• A client with IP 192.0.2.1 accesses a website through a reverse proxy at 198.51.100.1.
• A configured reverse proxy forwards the request with an appended X-Forwarded-For header that contains the actual client IP.
• The ThingWorx server receives and logs 192.0.2.1 as the client IP instead of the proxy IP.