Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a website running Apache and PHP. I see that there are visitors with IP addresses 172.16.33.197 and 127.0.0.1. These addresses do not belong to our network. I get the visitor IP addresses with following code snippet.

function GetUserIP() {

    if (isset($_SERVER)) {

        if (isset($_SERVER["HTTP_X_FORWARDED_FOR"]))
            return $_SERVER["HTTP_X_FORWARDED_FOR"];

        if (isset($_SERVER["HTTP_CLIENT_IP"]))
            return $_SERVER["HTTP_CLIENT_IP"];

        return $_SERVER["REMOTE_ADDR"];
    }

    if (getenv('HTTP_X_FORWARDED_FOR'))
        return getenv('HTTP_X_FORWARDED_FOR');

    if (getenv('HTTP_CLIENT_IP'))
        return getenv('HTTP_CLIENT_IP');

    return getenv('REMOTE_ADDR');
}

Why can I see that this IP address visiting my website? Does this indicate a security breach or a problem with my code?

share|improve this question
1  
Just a note, that 127.0.0.1 is the address for the localhost. It is also non-routable - so it was either sourced from your server, or it was faked there somehow. –  AviD Oct 22 '12 at 17:03
    
Try sending this packet to your server: GET / HTTP/1.1\r\nHost: example.com\r\nX-FORWARDED-FOR: cookies!\r\n\r\n Congrats, you just forged your own IP to 'cookies'! –  Luc Oct 22 '12 at 19:39
add comment

1 Answer

up vote 8 down vote accepted

Yes. If the user alters the HTTP_X_FORWARDED_FOR header, or any of the user-supplied headers you're checking with that code, they can forge the source IP. Ignore those headers and just use the REMOTE_ADDR value.

share|improve this answer
    
Just because they are user supplies does not mean they are supplied by your user. Many proxies happily provide that header. The HTTP_X_FORWARDED_FOR header can be safely used for a blacklist in conjunction with the REMOTE_ADDR. –  Brian Oct 22 '12 at 17:14
    
Both ip is listed for the same tcp request. How are tcp packets are returned to fake originating ip? Morever 172.16.33.197 is not publicly routable. –  nsumer Oct 22 '12 at 17:52
2  
@nsumer - That means it was forged. Your code is flawed. –  Ramhound Oct 22 '12 at 19:30
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.