PHP retrieving user ip, is really reliable? - php

Question

I'm developing a system where users are identified by their IP addresses, through this php script:
function visitorIP()
{
if(isset($_SERVER['HTTP_X_FORWARDED_FOR'])){
$TheIp=$_SERVER['HTTP_X_FORWARDED_FOR'];
}else{
$TheIp=$_SERVER['REMOTE_ADDR'];
}
return trim($TheIp);
}
$ip = visitorIP();
I wonder if this is a really safe way to retrieve the ip address. I'm not dealing with credit card numbers or money, so the system does not need to be super safe, but if this script is very easy to hack that could be a problem anyway. Thanks for any help.

Answer 1

The method you are using to get the IP is pretty standard for an Apache web server, however REMOTE_ADDR is not a reliable method to uniquely identify a user. Also as other people have noted, any of the 'HTTP_*' headers are easy to spoof.
The big issue is that identifying a user by IP Address is just plain problematic, and generally you wouldn't do it in a large system where you expect to see lots of users. I can think of several situations off the top of my head where it breaks down:
Home network with multiple users behind a typical router. All the computers/devices behind the router will be coming from the same IP.
Setting up your program behind a load balancer that forwards requests to your PHP server. REMOTE_ADDR will be the IP of the load balancer.
Users coming through a proxy service will all have the same IP as the proxy server.
ISPs often use DHCP to assign IP addresses to their customers. While not likely, it is theoretically possible that a user's IP address could change in the middle of a session if the DHCP lease time expires/renews.
It's likely your situation could be handled a lot better using sessions. Assign a user a session token the first time you see them rather than using their IP address, and make sure the token is passed (via cookies or part of the HTTP requests) on subsequent requests. When you get the token, you can be fairly confident it's the same user (sniffing attacks notwithstanding).
As an added bonus, you can combine IP tracking with sessions to make things more robust if you feel the need. For instance, a lot of applications will often try to figure out if a user's IP has changed, and invalidate a session as a result.

Answer 2

REMOTE_ADDR itself is your best bet IMO. Any $SERVER var with a HTTP prefix can be changed by the client so you shouldn't really trust it. Although, some proxies will forward the user's real IP in the HTTP_X_FORWARDED_FOR header.

Answer 3

Personally I would only use :
$_SERVER['REMOTE_ADDR'].
As
$_SERVER['HTTP_X_FORWARDED_FOR'];
Is lot easier to fake.
Identifying people solely on IPs is not the best idea. They are in general easy to fake/dodge by somebody with who has a need/want to.

Answer 4

Your combination is fairly standard (we use it for IP-based electronic subscription checking), though as others have noted it's not perfect.
Note that several forwarding IPs may be specified for HTTP_X_FORWARDED_FOR; see http://en.wikipedia.org/wiki/X-Forwarded-For#Format for details.