Fix client IP address detection to show real user IP instead of AppGateway internal IP

application/AppGateway/Program.cs

@@ -5,7 +5,6 @@
 using PlatformPlatform.AppGateway.Transformations;
 using PlatformPlatform.SharedKernel.Configuration;
 using Scalar.AspNetCore;
-using Yarp.ReverseProxy.Transforms;
 
 var builder = WebApplication.CreateBuilder(args);
 
@@ -14,12 +13,7 @@
     .LoadFromConfig(builder.Configuration.GetSection("ReverseProxy"))
     .AddConfigFilter<ClusterDestinationConfigFilter>()
     .AddConfigFilter<ApiExplorerRouteFilter>()
-    .AddTransforms(context =>
-        {
-            context.AddXForwarded();
-            context.RequestTransforms.Add(context.Services.GetRequiredService<BlockInternalApiTransform>());
-        }
-    );
+    .AddTransforms(context => context.RequestTransforms.Add(context.Services.GetRequiredService<BlockInternalApiTransform>()));
 
 if (SharedInfrastructureConfiguration.IsRunningInAzure)
 {

application/shared-kernel/SharedKernel/ExecutionContext/HttpExecutionContext.cs

@@ -39,7 +39,18 @@ public IPAddress ClientIpAddress
                 return field = IPAddress.None;
             }
 
-            // UseForwardedHeaders() middleware already processes X-Forwarded-For and sets RemoteIpAddress
+            // Read X-Forwarded-For header directly to get client IP (first IP in the chain is the original client)
+            var forwardedFor = httpContextAccessor.HttpContext.Request.Headers["X-Forwarded-For"].ToString();
+            if (!string.IsNullOrEmpty(forwardedFor))
+            {
+                var clientIp = forwardedFor.Split(',').FirstOrDefault()?.Trim();
+                if (IPAddress.TryParse(clientIp, out var parsedIpAddress))
+                {
+                    return field = NormalizeLoopbackAddress(parsedIpAddress);
+                }
+            }
+
+            // Fall back to RemoteIpAddress for local development without proxies
             var remoteIpAddress = httpContextAccessor.HttpContext.Connection.RemoteIpAddress ?? IPAddress.None;
             return field = NormalizeLoopbackAddress(remoteIpAddress);
         }