From 066b3a4a8103ecdf0c6f405ddf676c2cff2d3c33 Mon Sep 17 00:00:00 2001
From: feugy <damien@vercel.com>
Date: Thu, 1 Oct 2026 16:55:59 +0200
Subject: [PATCH] fix(server): stop sending x-vercel-ip

---
 packages/web/src/server/experiments.test.ts |  3 +--
 packages/web/src/server/index.test.ts       | 10 +++-------
 packages/web/src/server/request.ts          |  1 -
 3 files changed, 4 insertions(+), 10 deletions(-)

diff --git a/packages/web/src/server/experiments.test.ts b/packages/web/src/server/experiments.test.ts
index 9f5adcc..3f6893b 100644
--- a/packages/web/src/server/experiments.test.ts
+++ b/packages/web/src/server/experiments.test.ts
@@ -304,7 +304,7 @@ describe('trackExposure', () => {
       expect(body.props).toEqual({ valid: 'test' });
     });
 
-    it('reuses provided referer, user-agent, cookie and IP headers', async () => {
+    it('reuses provided referer, user-agent and cookie headers', async () => {
       const userAgent = 'custom-agent/2.0';
       const cookie = 'session=def456';
       const ip = '190.80.130.60';
@@ -325,7 +325,6 @@ describe('trackExposure', () => {
           headers: {
             'content-type': 'application/json',
             'user-agent': userAgent,
-            'x-vercel-ip': ip,
             cookie,
             'x-va-server': '1',
           },
diff --git a/packages/web/src/server/index.test.ts b/packages/web/src/server/index.test.ts
index e235469..5d9b310 100644
--- a/packages/web/src/server/index.test.ts
+++ b/packages/web/src/server/index.test.ts
@@ -212,7 +212,7 @@ describe('server track', () => {
       );
     });
 
-    it('reuses provided referer, user-agent, cookie and IP headers', async () => {
+    it('reuses provided referer, user-agent and cookie headers', async () => {
       const userAgent = 'custom-agent/2.0';
       const cookie = 'session=def456';
       const ip = '190.80.130.60';
@@ -238,7 +238,6 @@ describe('server track', () => {
           headers: {
             'content-type': 'application/json',
             'user-agent': userAgent,
-            'x-vercel-ip': ip,
             cookie,
             'x-va-server': '1',
           },
@@ -255,7 +254,7 @@ describe('server track', () => {
       );
     });
 
-    it("reuses provided request's referer, user-agent, cookie and IP", async () => {
+    it("reuses provided request's referer, user-agent and cookie", async () => {
       const userAgent = 'mobile-agent/2.0';
       const cookie = 'session=def456';
       const ip = '10.0.0.1';
@@ -281,7 +280,6 @@ describe('server track', () => {
           headers: {
             'content-type': 'application/json',
             'user-agent': userAgent,
-            'x-vercel-ip': ip,
             cookie,
             'x-va-server': '1',
           },
@@ -298,7 +296,7 @@ describe('server track', () => {
       );
     });
 
-    it('reuses provided referer, user-agent, cookie and IP options', async () => {
+    it('reuses provided referer, user-agent and cookie options', async () => {
       const userAgent = 'custom-agent/1.0';
       const cookie = 'session=abc123';
       const ip = '196.82.138.67';
@@ -324,7 +322,6 @@ describe('server track', () => {
           headers: {
             'content-type': 'application/json',
             'user-agent': userAgent,
-            'x-vercel-ip': ip,
             cookie,
             'x-va-server': '1',
           },
@@ -597,7 +594,6 @@ describe('server track', () => {
             headers: {
               'content-type': 'application/json',
               'user-agent': userAgent,
-              'x-vercel-ip': ip,
               cookie,
               'x-va-server': '1',
             },
diff --git a/packages/web/src/server/request.ts b/packages/web/src/server/request.ts
index 1de41ab..23190a4 100644
--- a/packages/web/src/server/request.ts
+++ b/packages/web/src/server/request.ts
@@ -220,7 +220,6 @@ export async function dispatch({
       headers: {
         'content-type': 'application/json',
         'user-agent': requestHeaders['user-agent'] as string,
-        'x-vercel-ip': requestHeaders['x-forwarded-for'] as string,
         'x-va-server': '1',
         cookie: requestHeaders.cookie as string,
         ...(BYPASS_SECRET