note 8417 modified in ref.session by yohgaki
| From: | yohgaki@php.net | Date: | Sat, 19 Jan 2002 06:23:13 +0000 |
| Subject: | note 8417 modified in ref.session by yohgaki | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-25091@lists.php.net to get a copy of this message | ||
In reply to dinky@pmail.net:
When you use REMOTE_ADDR for getting the IP of the current user,
sometimes you get the IP of the ISP Cache server.
When this happens, the HTTP_X_FORWARDED_FOR is also set, it
contains the IP of the user.
So with this script, you always get the right IP:
<PRE>
if (getenv(HTTP_X_FORWARDED_FOR)){
$ip=getenv(HTTP_X_FORWARDED_FOR);
}
else {
$ip=getenv(REMOTE_ADDR);
}
</PRE>
And also:
Note that the X-Forwarded for header might contain multiple addresses, comma separated, if the
request was forwarded through multiple proxies.
Finally, note that any user can add an X-Forwarded-For header themselves. The header is only good
for traceback information, never for authentication. If you use it for traceback, just log the
entire X-Forwarded-For header, along with the REMOTE_ADDR.
This text is written by :
c.k.karssen@student.tudelft.nl (before "And also:" and john-php@pc.xs4all.nl all other.
--
Editor's Note: We cannot trust HTTP_X_FORWARDED_FOR.
--was--
In reply to dinky@pmail.net:
When you use REMOTE_ADDR for getting the IP of the current user,
sometimes you get the IP of the ISP Cache server.
When this happens, the HTTP_X_FORWARDED_FOR is also set, it
contains the IP of the user.
So with this script, you always get the right IP:
<PRE>
if (getenv(HTTP_X_FORWARDED_FOR)){
$ip=getenv(HTTP_X_FORWARDED_FOR);
}
else {
$ip=getenv(REMOTE_ADDR);
}
</PRE>
And also:
Note that the X-Forwarded for header might contain multiple addresses, comma separated, if the
request was forwarded through multiple proxies.
Finally, note that any user can add an X-Forwarded-For header themselves. The header is only good
for traceback information, never for authentication. If you use it for traceback, just log the
entire X-Forwarded-For header, along with the REMOTE_ADDR.
This text is written by :
c.k.karssen@student.tudelft.nl (before "And also:" and john-php@pc.xs4all.nl all other.
http://www.php.net/manual/en/ref.session.php