v26.4.4
v26.4.4
Webhooks and claims hooks can read labels of the caller's IP address
Every Kratos webhook, the password migration hook, and the session JWT claims hook now receive ctx.ip_labels, a sorted array of
labels for the caller's IP address. It's always present, so a template written against the Ory Network keeps working on a
self-hosted deployment.
Kratos reads the labels from request headers. Each of these headers set to 1 adds its label:
| Header | Label |
|---|---|
X-Ory-Ip-Reputation-Anonymizer | ory:anonymizer |
X-Ory-Ip-Reputation-Open-Proxy | ory:open_proxy |
X-Ory-Ip-Reputation-Vpn | ory:vpn |
X-Ory-Ip-Reputation-Malware | ory:malware |
X-Ory-Ip-Reputation-Botnet-Cc | ory:botnet_cc |
Without a reverse proxy that sets these headers, ctx.ip_labels is an empty array. If your proxy sets them, it must also remove
them from every incoming request, or a caller can add labels to their own request.