🌍 IP Address Finder

Identifying client IP addresses requires understanding the HTTP headers modified as traffic passes through proxies. In a standard setup, a direct socket connection exposes the socket descriptor IP. However, on the modern web, applications usually sit behind CDNs (like Cloudflare) or load balancers (like AWS ALB or Nginx reverse proxies). This routing changes how backend systems identify the user.

Analyzing Proxied Client IP Headers

When a client requests a page through a reverse proxy, the proxy overwrites the socket connection's origin IP with its own. To pass the user's real IP to the backend application, the proxy adds custom headers. System administrators must inspect these headers to log data accurately:

• X-Forwarded-For: The standard HTTP header for identifying the originating IP address of a client connecting to a web server through an HTTP proxy. It can contain a list of comma-separated IPs if traffic passes through multiple proxies: X-Forwarded-For: client, proxy1, proxy2.
• X-Real-IP: A common header used by Nginx configurations that passes the client IP as a single value.
• CF-Connecting-IP: A custom header sent by Cloudflare proxy networks to identify the true visitor IP.

Preventing IP Spoofing in Server Applications

Developers must be careful when parsing X-Forwarded-For because clients can easily inject fake IP values into this header. If your system uses this header for security checks (like blocking bad IPs or limiting API access) without validating which proxies are trusted, it can be bypassed. Always configure your application framework to only trust headers from known proxy IP ranges, or read client IPs from trusted headers set by your CDN.

Detecting Client IP Address in PHP

The code below demonstrates a safe way to parse the visitor IP address in a PHP application, handling reverse proxies and fallback scenarios:

<?php
function getClientIpAddress() {
    $trustedProxies = ['127.0.0.1', '10.0.0.1']; // Add your reverse proxy IPs here
    $remoteAddr = $_SERVER['REMOTE_ADDR'] ?? '';

    if (in_array($remoteAddr, $trustedProxies)) {
        if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
            $ips = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);
            $clientIp = trim($ips[0]);
            if (filter_var($clientIp, FILTER_VALIDATE_IP)) {
                return $clientIp;
            }
        }
    }
    return $remoteAddr;
}
?>

Using these practices ensures that your network analytics remain accurate, access logs are correct, and your server endpoints are protected from spoofing attacks.