Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a website running Apache and PHP. I see that there are visitors with IP addresses and These addresses do not belong to our network. I get the visitor IP addresses with following code snippet.

function GetUserIP() {

    if (isset($_SERVER)) {

        if (isset($_SERVER["HTTP_X_FORWARDED_FOR"]))
            return $_SERVER["HTTP_X_FORWARDED_FOR"];

        if (isset($_SERVER["HTTP_CLIENT_IP"]))
            return $_SERVER["HTTP_CLIENT_IP"];

        return $_SERVER["REMOTE_ADDR"];

    if (getenv('HTTP_X_FORWARDED_FOR'))
        return getenv('HTTP_X_FORWARDED_FOR');

    if (getenv('HTTP_CLIENT_IP'))
        return getenv('HTTP_CLIENT_IP');

    return getenv('REMOTE_ADDR');

Why can I see that this IP address visiting my website? Does this indicate a security breach or a problem with my code?

share|improve this question
Just a note, that is the address for the localhost. It is also non-routable - so it was either sourced from your server, or it was faked there somehow. – AviD Oct 22 '12 at 17:03
Try sending this packet to your server: GET / HTTP/1.1\r\nHost:\r\nX-FORWARDED-FOR: cookies!\r\n\r\n Congrats, you just forged your own IP to 'cookies'! – Luc Oct 22 '12 at 19:39
up vote 8 down vote accepted

Yes. If the user alters the HTTP_X_FORWARDED_FOR header, or any of the user-supplied headers you're checking with that code, they can forge the source IP. Ignore those headers and just use the REMOTE_ADDR value.

share|improve this answer
Just because they are user supplies does not mean they are supplied by your user. Many proxies happily provide that header. The HTTP_X_FORWARDED_FOR header can be safely used for a blacklist in conjunction with the REMOTE_ADDR. – Brian Oct 22 '12 at 17:14
Both ip is listed for the same tcp request. How are tcp packets are returned to fake originating ip? Morever is not publicly routable. – nsumer Oct 22 '12 at 17:52
@nsumer - That means it was forged. Your code is flawed. – Ramhound Oct 22 '12 at 19:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.