Get the IP address of the remote host in ASP.NET Web API

This solution also covers Web API self-hosted using Owin. Partially from here.

You can create a private method in you ApiController that will return remote IP address no matter how you host your Web API:

 private const string HttpContext = "MS_HttpContext";
 private const string RemoteEndpointMessage =
     "System.ServiceModel.Channels.RemoteEndpointMessageProperty";
 private const string OwinContext = "MS_OwinContext";

 private string GetClientIp(HttpRequestMessage request)
 {
       // Web-hosting
       if (request.Properties.ContainsKey(HttpContext ))
       {
            HttpContextWrapper ctx = 
                (HttpContextWrapper)request.Properties[HttpContext];
            if (ctx != null)
            {
                return ctx.Request.UserHostAddress;
            }
       }

       // Self-hosting
       if (request.Properties.ContainsKey(RemoteEndpointMessage))
       {
            RemoteEndpointMessageProperty remoteEndpoint =
                (RemoteEndpointMessageProperty)request.Properties[RemoteEndpointMessage];
            if (remoteEndpoint != null)
            {
                return remoteEndpoint.Address;
            }
        }

       // Self-hosting using Owin
       if (request.Properties.ContainsKey(OwinContext))
       {
           OwinContext owinContext = (OwinContext)request.Properties[OwinContext];
           if (owinContext != null)
           {
               return owinContext.Request.RemoteIpAddress;
           }
       }

        return null;
 }

References required:

• HttpContextWrapper - System.Web.dll
• RemoteEndpointMessageProperty - System.ServiceModel.dll
• OwinContext - Microsoft.Owin.dll (you will have it already if you use Owin package)

A little problem with this solution is that you have to load libraries for all 3 cases when you will actually be using only one of them during runtime. As suggested here, this can be overcome by using dynamic variables. You can also write GetClientIpAddress method as an extension for HttpRequestMethod.

using System.Net.Http;

public static class HttpRequestMessageExtensions
{
    private const string HttpContext = "MS_HttpContext";
    private const string RemoteEndpointMessage =
        "System.ServiceModel.Channels.RemoteEndpointMessageProperty";
    private const string OwinContext = "MS_OwinContext";

    public static string GetClientIpAddress(this HttpRequestMessage request)
    {
       // Web-hosting. Needs reference to System.Web.dll
       if (request.Properties.ContainsKey(HttpContext))
       {
           dynamic ctx = request.Properties[HttpContext];
           if (ctx != null)
           {
               return ctx.Request.UserHostAddress;
           }
       }

       // Self-hosting. Needs reference to System.ServiceModel.dll. 
       if (request.Properties.ContainsKey(RemoteEndpointMessage))
       {
            dynamic remoteEndpoint = request.Properties[RemoteEndpointMessage];
            if (remoteEndpoint != null)
            {
                return remoteEndpoint.Address;
            }
        }

       // Self-hosting using Owin. Needs reference to Microsoft.Owin.dll. 
       if (request.Properties.ContainsKey(OwinContext))
       {
           dynamic owinContext = request.Properties[OwinContext];
           if (owinContext != null)
           {
               return owinContext.Request.RemoteIpAddress;
           }
       }

        return null;
    }
}

Now you can use it like this:

public class TestController : ApiController
{
    [HttpPost]
    [ActionName("TestRemoteIp")]
    public string TestRemoteIp()
    {
        return Request.GetClientIpAddress();
    }
}

If you really want a one-liner and don't plan to self-host Web API:

((System.Web.HttpContextWrapper)Request.Properties["MS_HttpContext"]).Request.UserHostAddress;

Above answers require a reference to System.Web to be able to cast the property to HttpContext or HttpContextWrapper. If you don't want the reference, you are able to get the ip using a dynamic:

var host = ((dynamic)request.Properties["MS_HttpContext"]).Request.UserHostAddress;

When the server is behind a proxy or a load balancer the marked solution will return the internal IP address of the proxy. In our case, our production environment is using a load balancer and our development and test environments are not so I've amended the marked solution to fit both cases in the same code.

public string GetSourceIp(HttpRequestMessage httpRequestMessage)
    {
        string result = string.Empty;

        // Detect X-Forwarded-For header
        if (httpRequestMessage.Headers.TryGetValues("X-Forwarded-For", out IEnumerable<string> headerValues))
        {
            result = headerValues.FirstOrDefault();
        }
        // Web-hosting
        else if (httpRequestMessage.Properties.ContainsKey("MS_HttpContext"))
        {
            result = ((HttpContextWrapper)httpRequestMessage.Properties["MS_HttpContext"]).Request.UserHostAddress;
        }
        // Self-hosting
        else if (httpRequestMessage.Properties.ContainsKey(RemoteEndpointMessageProperty.Name))
        {
            RemoteEndpointMessageProperty prop;
            prop = (RemoteEndpointMessageProperty)httpRequestMessage.Properties[RemoteEndpointMessageProperty.Name];
            result = prop.Address;
        }

        return result;
    }

Based on Asaff Belfer's answer, here's a couple of basic methods that I used to deploy this to an Azure Function (serverless / consumption plan) to obtain both the client IP and the client user agent. Also included a bit that is supposed to work in APIM, but have not tested that part yet. That information about APIM can be found at Stefano Demiliani's blog.

NOTE: these will return "(not available)" for local / self hosting. Someone can fix these to include self hosting, but I could not use those bits as the required Nuget packages from Asaff's answer (and others here) don't appear to work on the target framework I'm using (.NET 6.0).

public static string GetSourceIp(HttpRequestMessage httpRequestMessage)
{
    string result = "(not available)";
    // Detect X-Forwarded-For header
    if (httpRequestMessage.Headers.TryGetValues("X-Forwarded-For", out IEnumerable<string> headerValues))
    {
        result = headerValues.FirstOrDefault();
    }
    //for use with APIM, see https://demiliani.com/2022/07/11/azure-functions-getting-the-client-ip-address
    if (httpRequestMessage.Headers.TryGetValues("X-Forwarded-Client-Ip", out IEnumerable<string> headerValues2))
    {
        result = headerValues2.FirstOrDefault();
    }
    return result;
}

public static string GetClientUserAgent(HttpRequestMessage httpRequestMessage)
{
    string result = "(not available)";
    // Detect user-agent header
    if (httpRequestMessage.Headers.TryGetValues("user-agent", out IEnumerable<string> headerValues))
    {
        result = string.Join(", ", headerValues);
    }
    return result;
}

Usage would be as follows:

string clientUserAgent = GetClientUserAgent(httpRequestMessage);
string clientIP = GetSourceIp(httpRequestMessage);

Hosted locally on my dev box using a Chrome browser, these returned:

User IP Address: (not available)

User Client: Mozilla/5.0, (Windows NT 10.0; Win64; x64), AppleWebKit/537.36, (KHTML, like Gecko), Chrome/108.0.0.0, Safari/537.36

Hosted in my serverless function in Azure commercial, using a Chrome browser, these returned:

User IP Address: 999.999.999.999:12345 (Of course, this is not a real IP address. I assume the 12345 part is a port number.)

User Client: Mozilla/5.0, (Windows NT 10.0; Win64; x64), AppleWebKit/537.36, (KHTML, like Gecko), Chrome/108.0.0.0, Safari/537.36