note 8417 deleted from ref.session by sniper
| From: | sniper@php.net | Date: | Tue, 21 Jan 2003 03:27:43 +0000 |
| Subject: | note 8417 deleted from ref.session by sniper | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-42500@lists.php.net to get a copy of this message | ||
In reply to dinky@pmail.net:
When you use REMOTE_ADDR for getting the IP of the current user,
sometimes you get the IP of the ISP Cache server.
When this happens, the HTTP_X_FORWARDED_FOR is also set, it
contains the IP of the user.
So with this script, you always get the right IP:
<PRE>
if (getenv(HTTP_X_FORWARDED_FOR)){
$ip=getenv(HTTP_X_FORWARDED_FOR);
}
else {
$ip=getenv(REMOTE_ADDR);
}
</PRE>
And also:
Note that the X-Forwarded for header might contain multiple addresses, comma separated, if the
request was forwarded through multiple proxies.
Finally, note that any user can add an X-Forwarded-For header themselves. The header is only good
for traceback information, never for authentication. If you use it for traceback, just log the
entire X-Forwarded-For header, along with the REMOTE_ADDR.
This text is written by :
c.k.karssen@student.tudelft.nl (before "And also:" and john-php@pc.xs4all.nl all other.
--
Editor's Note: We cannot trust HTTP_X_FORWARDED_FOR.