set $ _SERVER ['HTTP_CLIENT_IP']的值是否为空字符串？

Question

我有一个简单的脚本来确定用户的IP地址:

function GetIp(){
      if (!empty($_SERVER['HTTP_CLIENT_IP']))
      //check ip from share internet
      {
        $ip=$_SERVER['HTTP_CLIENT_IP'];
      }
      elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR']))
      //to check ip is pass from proxy
      {
        $ip=$_SERVER['HTTP_X_FORWARDED_FOR'];
      }
      else
      {
        $ip=$_SERVER['REMOTE_ADDR'];
      }
      return $ip;
}

现在在网上我看到有人使用这个脚本:

if (isset($_SERVER['HTTP_CLIENT_IP']) && $_SERVER['HTTP_CLIENT_IP'] != '')
        $Ip = $_SERVER['HTTP_CLIENT_IP'];
    elseif (isset($_SERVER['HTTP_X_FORWARDED_FOR']) && $_SERVER['HTTP_X_FORWARDED_FOR'] != '')
        $Ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
    elseif (isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] != '')
        $Ip = $_SERVER['REMOTE_ADDR'];

我在想,如果我的实现是坏了..我是否需要检查,如果该值$_SERVER['HTTP_CLIENT_IP'],$_SERVER['HTTP_X_FORWARDED_FOR']或者$_SERVER['REMOTE_ADDR']是空的？或者实际上没必要这样做？

Answer 1

如果您想要找出客户端的IP地址的原因非常重要,请将所有这些内容搞砸.

这些标头值中的任何一个都可以自由欺骗.

REMOTE_ADDR是唯一真正可靠的信息,因为它是由处理请求的Web服务器传输给您的.理论上它也可以被伪造,但这比欺骗标题值和完全不同类型的攻击要困难得多.

在反向代理背后的非常非常具体的托管环境中有例外.在这些情况下,管理该代理的人将能够告知您需要测试的标头值.

Answer 2

来自Kohanas的请求类:

if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])
    AND isset($_SERVER['REMOTE_ADDR'])
    AND in_array($_SERVER['REMOTE_ADDR'], Request::$trusted_proxies))
{
    // Use the forwarded IP address, typically set when the
    // client is using a proxy server.
    // Format: "X-Forwarded-For: client1, proxy1, proxy2"
    $client_ips = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);

    Request::$client_ip = array_shift($client_ips);

    unset($client_ips);
}
elseif (isset($_SERVER['HTTP_CLIENT_IP'])
    AND isset($_SERVER['REMOTE_ADDR'])
    AND in_array($_SERVER['REMOTE_ADDR'], Request::$trusted_proxies))
{
    // Use the forwarded IP address, typically set when the
    // client is using a proxy server.
    $client_ips = explode(',', $_SERVER['HTTP_CLIENT_IP']);

    Request::$client_ip = array_shift($client_ips);

    unset($client_ips);
}
elseif (isset($_SERVER['REMOTE_ADDR']))
{
    // The remote IP address
    Request::$client_ip = $_SERVER['REMOTE_ADDR'];
}

这非常好.请注意Request::$trusted_proxies数组,在这种情况下你的$ipvar Request::$client_ip.

Answer 3

HTTP_*除非您明确知道您的应用程序是在反向代理后面配置的,否则请勿检查客户端IP的任何标头.无条件地信任这些标头的值将允许用户欺骗他们的IP地址.

唯一$_SERVER包含可靠值的字段是REMOTE_ADDR.