IPv4 vs IPv6 Explained: How Developers Can Reliably Detect User IP Addresses

IP addresses come in two formats: IPv4, a 32-bit system with roughly 4.3 billion addresses, and IPv6, a 128-bit system designed to overcome IPv4 exhaustion with a near-unlimited address space. Developers must also distinguish between public IPs, routable on the internet, and private IPs reserved for local networks such as the 192.168.x.x range. When building backend applications, the IP a server receives is not always the true client IP, particularly when requests pass through proxies, load balancers, or CDNs like Cloudflare. In Node.js and Python, developers can read the X-Forwarded-For header to retrieve the original client IP, though the first value in the list should be treated as untrusted unless the proxy chain is controlled. Security-critical functions such as rate limiting or geofencing should never rely solely on client-reported IP headers, as these can be spoofed without proper edge-level validation.