blocks|key|3946246|text|HTTP_CLIENT_IP是获取用户IP地址的最可靠方法。接下来是HTTP_X_FORWARDED_FOR，然后是REMOTE_ADDR。假设设置的第一个变量(如果设置了该变量，则isset($_SERVER['HTTP_CLIENT_IP'])返回true+)是正确的，请按该顺序选中所有这三个变量。您可以使用各种方法独立检查用户是否正在使用代理。查看this。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|3946247|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/questions/4527345/determine-if-user-is-using-proxy^0|2J|X|4Y|4|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@$9|O|A|P|B|C]]|D|@$9|Q|A|R|1|S]]|E|$]]|$1|F|3|-4|5|6|7|T|8|@]|D|@]|E|$]]]|G|$H|$5|I|J|K|E|$L|M]]]]

HTTP_CLIENT_IP is the most reliable way of getting the user's IP address. Next is HTTP_X_FORWARDED_FOR, followed by REMOTE_ADDR. Check all three, in that order, assuming that the first one that is set (<code>isset($_SERVER['HTTP_CLIENT_IP'])</code> returns true if that variable is set) is correct. You can independently check if the user is using a proxy using various methods. Check <a href="https://stackoverflow.com/questions/4527345/determine-if-user-is-using-proxy">this</a> out.

blocks|key|1836608|text|您可以使用此函数获取正确的客户端IP：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1836609|public+function+getClientIP(){+++++++
+++++if+(array_key_exists('HTTP_X_FORWARDED_FOR',+$_SERVER)){
++++++++++++return++$_SERVER["HTTP_X_FORWARDED_FOR"];++
+++++}else+if+(array_key_exists('REMOTE_ADDR',+$_SERVER))+{+
++++++++++++return+$_SERVER["REMOTE_ADDR"];+
+++++}else+if+(array_key_exists('HTTP_CLIENT_IP',+$_SERVER))+{
++++++++++++return+$_SERVER["HTTP_CLIENT_IP"];+
+++++}+

+++++return+'';
}|code-block|syntax|javascript|1836610|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

You can use this function to get proper client IP:

<pre><code>public function getClientIP(){ 
 if (array_key_exists('HTTP_X_FORWARDED_FOR', $_SERVER)){
 return $_SERVER["HTTP_X_FORWARDED_FOR"]; 
 }else if (array_key_exists('REMOTE_ADDR', $_SERVER)) { 
 return $_SERVER["REMOTE_ADDR"]; 
 }else if (array_key_exists('HTTP_CLIENT_IP', $_SERVER)) {
 return $_SERVER["HTTP_CLIENT_IP"]; 
 } 

 return '';
}
</code></pre>

blocks|key|1836676|text|我喜欢Hrishikesh的回答，对于这个问题，我只对add...because有这样的回答，当使用多个代理时，我们看到一个逗号分隔的字符串，我们发现有必要添加一个分解并获取最终的值，如下所示：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1836677|$IParray=array_values(array_filter(explode(',',$_SERVER['HTTP_X_FORWARDED_FOR'])));
return+reset($IParray);|code-block|syntax|javascript|1836678|array_filter是用来删除空条目的。|1836679|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

I like Hrishikesh's answer, to which I only have this to add...because we saw a comma-delimited string coming across when multiple proxies along the way were used, we found it necessary to add an explode and grab the final value, like this:
<pre><code>$IParray=array_values(array_filter(explode(',',$_SERVER['HTTP_X_FORWARDED_FOR'])));
return reset($IParray);
</code></pre>
the array_filter is in there to remove empty entries.

blocks|key|1539977|text|如果您在数据库中使用它，这是一个很好的方法：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1539978|将数据库中的ip字段设置为varchar(250)，然后使用以下命令：|1539979|$theip+=+$_SERVER["REMOTE_ADDR"];

if+(!empty($_SERVER["HTTP_X_FORWARDED_FOR"]))+{
++++$theip+.=+'('.$_SERVER["HTTP_X_FORWARDED_FOR"].')';
}

if+(!empty($_SERVER["HTTP_CLIENT_IP"]))+{
++++$theip+.=+'('.$_SERVER["HTTP_CLIENT_IP"].')';
}

$realip+=+substr($theip,+0,+250);|code-block|syntax|javascript|1539980|然后，您只需根据数据库ip字段检查$realip|1539981|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|N|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|O|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|P|8|@]|9|@]|A|$]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

If you use it in a database, this is a good way:

Set the ip field in database to varchar(250), and then use this:

<pre><code>$theip = $_SERVER["REMOTE_ADDR"];

if (!empty($_SERVER["HTTP_X_FORWARDED_FOR"])) {
 $theip .= '('.$_SERVER["HTTP_X_FORWARDED_FOR"].')';
}

if (!empty($_SERVER["HTTP_CLIENT_IP"])) {
 $theip .= '('.$_SERVER["HTTP_CLIENT_IP"].')';
}

$realip = substr($theip, 0, 250);
</code></pre>

Then you just check $realip against the database ip field

blocks|key|5363954|text|鉴于最新的httpoxy漏洞，确实需要一个完整的示例，即如何正确使用HTTP_X_FORWARDED_FOR。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|5363955|这里有一个用PHP编写的示例，如何检测客户端IP地址，如果您知道客户端可能位于代理服务器之后，并且知道此代理服务器是可信的。如果您不知道任何受信任的代理，只需使用REMOTE_ADDR|5363956|<?php

function+get_client_ip+()
{
++++//+Nothing+to+do+without+any+reliable+information
++++if+(!isset+($_SERVER['REMOTE_ADDR']))+{
++++++++return+NULL;
++++}

++++//+Header+that+is+used+by+the+trusted+proxy+to+refer+to
++++//+the+original+IP
++++$proxy_header+=+"HTTP_X_FORWARDED_FOR";

++++//+List+of+all+the+proxies+that+are+known+to+handle+'proxy_header'
++++//+in+known,+safe+manner
++++$trusted_proxies+=+array+("2001:db8::1",+"192.168.50.1");

++++if+(in_array+($_SERVER['REMOTE_ADDR'],+$trusted_proxies))+{

++++++++//+Get+the+IP+address+of+the+client+behind+trusted+proxy
++++++++if+(array_key_exists+($proxy_header,+$_SERVER))+{

++++++++++++//+Header+can+contain+multiple+IP-s+of+proxies+that+are+passed+through.
++++++++++++//+Only+the+IP+added+by+the+last+proxy+(last+IP+in+the+list)+can+be+trusted.
++++++++++++$proxy_list+=+explode+(",",+$_SERVER[$proxy_header]);
++++++++++++$client_ip+=+trim+(end+($proxy_list));

++++++++++++//+Validate+just+in+case
++++++++++++if+(filter_var+($client_ip,+FILTER_VALIDATE_IP))+{
++++++++++++++++return+$client_ip;
++++++++++++}+else+{
++++++++++++++++//+Validation+failed+-+beat+the+guy+who+configured+the+proxy+or
++++++++++++++++//+the+guy+who+created+the+trusted+proxy+list?
++++++++++++++++//+TODO:+some+error+handling+to+notify+about+the+need+of+punishment
++++++++++++}
++++++++}
++++}

++++//+In+all+other+cases,+REMOTE_ADDR+is+the+ONLY+IP+we+can+trust.
++++return+$_SERVER['REMOTE_ADDR'];
}

print+get_client_ip+();

?>|code-block|syntax|javascript|5363957|entityMap|0|LINK|mutability|MUTABLE|url|https://httpoxy.org/^0|Y|K|5|7|0|0|29|B|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@$9|V|A|W|B|C]]|D|@$9|X|A|Y|1|Z]]|E|$]]|$1|F|3|G|5|6|7|10|8|@$9|11|A|12|B|C]]|D|@]|E|$]]|$1|H|3|I|5|J|7|13|8|@]|D|@]|E|$K|L]]|$1|M|3|-4|5|6|7|14|8|@]|D|@]|E|$]]]|N|$O|$5|P|Q|R|E|$S|T]]]]

In the light of the latest <a href="https://httpoxy.org/" rel="noreferrer">httpoxy</a> vulnerabilities, there is really a need for a full example, how to use <code>HTTP_X_FORWARDED_FOR</code> properly.

So here is an example written in PHP, how to detect a client IP address, if you know that client may be behind a proxy and you know this proxy can be trusted. If you don't known any trusted proxies, just use <code>REMOTE_ADDR</code>

<pre><code>&lt;?php

function get_client_ip ()
{
 // Nothing to do without any reliable information
 if (!isset ($_SERVER['REMOTE_ADDR'])) {
 return NULL;
 }

 // Header that is used by the trusted proxy to refer to
 // the original IP
 $proxy_header = "HTTP_X_FORWARDED_FOR";

 // List of all the proxies that are known to handle 'proxy_header'
 // in known, safe manner
 $trusted_proxies = array ("2001:db8::1", "192.168.50.1");

 if (in_array ($_SERVER['REMOTE_ADDR'], $trusted_proxies)) {

 // Get the IP address of the client behind trusted proxy
 if (array_key_exists ($proxy_header, $_SERVER)) {

 // Header can contain multiple IP-s of proxies that are passed through.
 // Only the IP added by the last proxy (last IP in the list) can be trusted.
 $proxy_list = explode (",", $_SERVER[$proxy_header]);
 $client_ip = trim (end ($proxy_list));

 // Validate just in case
 if (filter_var ($client_ip, FILTER_VALIDATE_IP)) {
 return $client_ip;
 } else {
 // Validation failed - beat the guy who configured the proxy or
 // the guy who created the trusted proxy list?
 // TODO: some error handling to notify about the need of punishment
 }
 }
 }

 // In all other cases, REMOTE_ADDR is the ONLY IP we can trust.
 return $_SERVER['REMOTE_ADDR'];
}

print get_client_ip ();

?&gt;
</code></pre>

blocks|key|5363971|text|您也可以使用mod_remoteip通过Apache配置来解决此问题，方法是将以下内容添加到conf.d文件中：|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|5363972|RemoteIPHeader+X-Forwarded-For
RemoteIPInternalProxy+172.16.0.0/12
LogFormat+"%25a+%25l+%25u+%25t+\"%25r\"+%25>s+%25b+\"%25{Referer}i\"+\"%25{User-Agent}i\""+combined|code-block|syntax|javascript|5363973|entityMap|0|LINK|mutability|MUTABLE|url|https://httpd.apache.org/docs/current/mod/mod_remoteip.html^0|6|C|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@$A|R|B|S|1|T]]|C|$]]|$1|D|3|E|5|F|7|U|8|@]|9|@]|C|$G|H]]|$1|I|3|-4|5|6|7|V|8|@]|9|@]|C|$]]]|J|$K|$5|L|M|N|C|$O|P]]]]

You can also solve this problem via Apache configuration using <a href="https://httpd.apache.org/docs/current/mod/mod_remoteip.html" rel="nofollow noreferrer">mod_remoteip</a>, by adding the following to a conf.d file:

<pre><code>RemoteIPHeader X-Forwarded-For
RemoteIPInternalProxy 172.16.0.0/12
LogFormat "%a %l %u %t \"%r\" %&gt;s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
</code></pre>

blocks|key|5363990|text|请注意，"HTTP_X_FORWARDED_FOR“可以很容易地被欺骗来更改条目，例如使用浏览器插件...所以请注意！|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5363991|尝试这个来自Hrishikesh+Mishra的修改过的代码(未测试)：|5363992|+function+getClientIP(){++

+if+(array_key_exists('HTTP_X_FORWARDED_FOR',+$_SERVER)+&&+preg_match('/\b((25[0-5]%7C2[0-4][0-9]%7C[01]?[0-9][0-9]?)(\.%7C$)){4}\b/',+$_SERVER["HTTP_X_FORWARDED_FOR"])){
++++++++return++$_SERVER["HTTP_X_FORWARDED_FOR"];++
+}else+if+(array_key_exists('REMOTE_ADDR',+$_SERVER))+{+
++++++++return+$_SERVER["REMOTE_ADDR"];+
+}else+if+(array_key_exists('HTTP_CLIENT_IP',+$_SERVER))+{
++++++++return+$_SERVER["HTTP_CLIENT_IP"];+
+}+

+return+'';
}|code-block|syntax|javascript|5363993|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|L|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|M|8|@]|9|@]|A|$G|H]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

Please note that the &quot;HTTP_X_FORWARDED_FOR&quot; can be spoofed very easy to change the entry for example with Browser Plugins ... so please be aware!
Try this modified Code from Hrishikesh Mishra (not tested):
<pre><code> function getClientIP(){ 

 if (array_key_exists('HTTP_X_FORWARDED_FOR', $_SERVER) &amp;&amp; preg_match('/\b((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\.|$)){4}\b/', $_SERVER[&quot;HTTP_X_FORWARDED_FOR&quot;])){
 return $_SERVER[&quot;HTTP_X_FORWARDED_FOR&quot;]; 
 }else if (array_key_exists('REMOTE_ADDR', $_SERVER)) { 
 return $_SERVER[&quot;REMOTE_ADDR&quot;]; 
 }else if (array_key_exists('HTTP_CLIENT_IP', $_SERVER)) {
 return $_SERVER[&quot;HTTP_CLIENT_IP&quot;]; 
 } 

 return '';
}
</code></pre>

Alright, I have an small authentication issue. My web service allows to connect to my API over HTTP with a username and password, but this connection can also be restricted to a specific IP address.

This means that the <code>$_SERVER['REMOTE_ADDR']</code> can be incorrect. I already know that any IP information can never truly be relied upon - I have the restriction only in an attempt to add another layer of security.

If this is the general overview of a request to my web server:

<code>clientSERVER =&gt; clientPROXY =&gt; myPROXY =&gt; mySERVER</code>

Then this means that mySERVER shows <code>REMOTE_ADDR</code> of myPROXY instead of that of the client and sends the actual IP of the client as <code>HTTP_X_FORWARDED_FOR</code>.

To overcome this, my web service has a list of 'trusted proxy' IP addresses and if <code>REMOTE_ADDR</code> is from one of those trusted IP addresses, then it tells my web service that the actual IP address is the value of <code>HTTP_X_FORWARDED_FOR</code>.

Now the problem is with clientPROXY. This means that (quite often) mySERVER gets <code>HTTP_X_FORWARDED_FOR</code> value that has multiple IP addresses. According to <code>HTTP_X_FORWARDED_FOR</code> documentation, the value is a comma-separated list of IP addresses where the first IP is that of the actual true client and every other IP address is that of a proxy.

So, if <code>HTTP_X_FORWARDED_FOR</code> has multiple values and my service is IP restricted, do I have to check the 'last' value of <code>HTTP_X_FORWARDED_FOR</code> against my allowed IP list and just ignore the actual client IP?

I assume that in a system, where I have to set the list of allowed IP addresses, the whitelisted IP address should be that of a proxy and not an IP that is behind the proxy (since that could be some localhost IP and change frequently).

And what of <code>HTTP_CLIENT_IP</code>?

How to use HTTP_X_FORWARDED_FOR properly?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

好吧，我有一个小的身份验证问题。我的web服务允许使用用户名和密码通过HTTP连接到我的API，但此连接也可以限制为特定的IP地址。这意味着$_SERVER['REMOTE_ADDR']可能是不正确的。我已经知道，任何IP信息都不能真正依赖-我的限制只是为了增加另一层安全。如果这是对我的web服务器的请求的一般概述：c...

问如何正确使用HTTP_X_FORWARDED_FOR？
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何正确使用HTTP_X_FORWARDED_FOR？EN