From 06656274c3f08a1685fd3d2bdae2dda07ee49d30 Mon Sep 17 00:00:00 2001
From: Vasily Gerasimov <UgnineSirdis@ydb.tech>
Date: Mon, 8 Sep 2025 12:47:03 +0200
Subject: [PATCH] Http audit: get remote_address from socket if didn't manage
 to get it from headers (#24363)

(cherry picked from commit 203fdd52605bb4eae350f71c1d5857bf90446ab7)
---
 ydb/core/mon/audit/audit.cpp | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/ydb/core/mon/audit/audit.cpp b/ydb/core/mon/audit/audit.cpp
index f88f8d00a3d0..8bcde6a2444e 100644
--- a/ydb/core/mon/audit/audit.cpp
+++ b/ydb/core/mon/audit/audit.cpp
@@ -4,6 +4,7 @@
 #include <ydb/core/audit/audit_log.h>
 #include <ydb/core/audit/audit_config/audit_config.h>
 #include <ydb/core/base/appdata.h>
+#include <ydb/core/util/address_classifier.h>
 #include <ydb/library/aclib/aclib.h>
 
 #include <util/generic/is_in.h>
@@ -96,7 +97,10 @@ void TAuditCtx::InitAudit(const NHttp::TEvHttpProxy::TEvHttpIncomingRequest::TPt
         return;
     }
 
-    auto remoteAddress = ToString(headers.Get(X_FORWARDED_FOR_HEADER).Before(',')); // Get the first address in the list
+    TString remoteAddress = ToString(headers.Get(X_FORWARDED_FOR_HEADER).Before(',')); // Get the first address in the list
+    if (remoteAddress.empty()) {
+        remoteAddress = NKikimr::NAddressClassifier::ExtractAddress(request->Address->ToString());
+    }
 
     AddAuditLogPart("component", MONITORING_COMPONENT_NAME);
     AddAuditLogPart("remote_address", remoteAddress);