Client-side XHR request, which IP does the endpoint read?

Question

Assume a Javascript plugin, for a developer, that's included on their website.

<script src="https://external.com/plugin.js"></script>

The plugin makes a XHR request to a 3rd party endpoint (API). So, which IP is detected at that endpoint? Is it the developer's host IP, the client IP running the script, the external script's IP?

Throttling happens per IP. So just wondering which IP is sent in this scenario. Not in a position right now to run tests.

Answer 1

The browser will download the contents of the JavaScript file and execute it - this all happens on the client's machine, so the XHR request will have the IP address from the client. It doesn't really matter if the script is externally hosted or embedded directly into the HTML.