IssueTracker

Currently  Google App Engine Flex logs the remoteIp based on the X-Forwarded-For header. This gives opportunity to spoof client IP address. For example running curl -H "X-Forwarded-For: Hello" <appengine_flex_url> results into log snippet like below and can be seen in the logs explorer.

{
  httpRequest: {
  latency: "1.272s"
  protocol: "HTTP/1.1"
  referer: "-"
  remoteIp: "hello"
  requestMethod: "GET"
  requestUrl: "/"
  responseSize: "35"
  status: 200
  userAgent: "curl/7.64.0"
}}

Feature Request:   GAE nginx web server logs should show the actual remote IP address of the client application instead of deriving it from X-FORWARDED-FOR header.

Please note that this feature request has been forwarded to the Google App Engine product management team so that they may evaluate it. There is no timeline or implementation guarantee for feature requests. All communication regarding this feature request is to be done on this public issue tracker.