There's only one scenario in which you can trust this information: you are controlling the proxy that sets this header. Anything else is just arbitrary and voluntary information. $_SERVER is the actual physical IP address that the web server received the connection from and that the response will be sent to. There's no guarantee about their content.
The problem is that those are merely HTTP headers which can be set by anyone. There are several HTTP headers like X-Forwarded-For which may or may not be set by various proxies. Someone's private RFC1918 address may not do you any good if you're say, trying to see where your traffic is originating from, or remembering what IP the user last connected from, where the public IP of the proxy or NAT gateway might be the more appropriate to store. Well be what you really want, though, depending what your doing with the IPs. $_SERVER may not actually contain real client IP addresses, as it will give you a proxy address for clients connected through a proxy, for example. So if you know what you are doing you can use 39 characters, but if you just want to set and forget it, use 45). (Note that IPv6 usually uses 39 characters at most but there is also a special IPv6 notation for IPv4 addresses which in its full form can be up to 45 characters. IPv6 is here to stay and those addresses are larger than the older IPv4 addresses. If you are going to save the IP to a database as a string, make sure you have space for at least 45 characters. by saving both values in different fields in your database. This means that if you are going to save the $_SERVER, make sure you also save the $_SERVER value. For example, it can be set by someone without a proxy, or the IP can be an internal IP from the LAN behind the proxy.
However, they can be behind a proxy server in which case the proxy may have set the $_SERVER, but this value is easily spoofed. That is the most reliable value you can find. $_SERVER contains the real IP address of the connecting party. Whatever you do, make sure not to trust data sent from the client.
0 kommentar(er)
