3 ms·
The logic in the php snippet which captures IP addresses is not correct. Any user is able to add an x-forwarded-for header to mask their real IP from the logs.
by hsbauauvhabzb 5y ago
The logic in the php snippet which captures IP addresses is not correct. Any user is able to add an x-forwarded-for header to mask their real IP from the logs.
I wouldn’t be surprised if the log file can have additional entries spoofed with new lines also ;)
- chmod775 5y agoNot necessarily. That code could be written assuming it is running behind a reverse proxy/other infrastructure (that would obviously strip/replace any x-forwarded-for etc. provided by the user). The comments seem to indicate it is running behind a proxy of the author's choosing, but that may just be bad English. At the very least something has to be providing that HTTP_CLIENT_IP which is given the highest priority. It would be odd to prioritize that over HTTP_X_FORWARDED_FOR if you weren't adding special cases for different upstream proxies.