-
Notifications
You must be signed in to change notification settings - Fork 118
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Get the ip when the user is using a proxy #504
Get the ip when the user is using a proxy #504
Conversation
Nice find! We need all the headers we can get! You added the PR just as I made some changes to the files. I'll make sure to add your changes. It's some really great findings that can maximize the support so it works for everyone. However your request gave me an idea. Instead of checking for multiple headers manually, why not just let the I simplified the /**
* Get id address
* @return string|null
*/
public function getIp(): ?string
{
return $this->getHeader(
'http-cf-connecting-ip',
$this->getHeader(
'http-x-forwarded-for',
$this->getHeader('remote-addr')
)
);
} Instead i'm create a new method $request->getHeaderFromArray([
'http-x-forwarded-for',
'remote-addr', //etc
]); |
Sounds great, but don't forget to add the validation and the $safe parameter before the ip is returned^^ |
Yeah, i'm guessing all the Thanks for the PR this is definitely some useful info! |
Should I create that function or are you already on it? |
It's already made but not yet committed :) |
Okay, perfect! |
Okay, I updated it and the function now uses the new getHeader syntax, Can you pease commit the |
31be63c
to
5508c73
Compare
Do you think we still could add this pull to 4.3.0.0 or is it better for you if we add it later? ~ Marius |
Ready to merge^^ |
I've checked out your branch but i cant remember how I push to this pull request.. do you by any change remember? |
I have never worked with pull requests before and never as a project owner... |
Think i figured it out. I have to add your repository to my git config and then push it to your branch/pull request. But back in the day github had a nice little instruction in the bottom on how to push changes with copy-paste examples. |
I think you have to clone my repro yes: |
Hello,
multiple sources also use the
HTTP_CLIENT_IP
header with theHTTP_X_FORWARDED_FOR
to check if the user is using a proxy.Here is an explaination, what the difference is and here is an example that explains the headers.
But as pointed out in this comment and with some thinking back to our custom/ client headers with the
http-
prefix, the user is able to edit this header. This could lead to security issues. I know only some people can do this, but it is still an issue.I added the cloudflare ip header to the non save headers, because a user can set this header when the website isn't using cloudflare and like the other two headers, submit any value he wants.
~ Marius