Can we not really do Web server-side limit User IP?

Just asked a nginx forward upstream to change the forwarding source IP problem, since the access request source IP can be arbitrarily changed, then we in the Web server to obtain the IP is not fully believe, then we should be what way to restrict the user real IP, or is it true this road is not feasible?

Reply content:

Just asked a nginx forward upstream to change the forwarding source IP problem, since the access request source IP can be arbitrarily changed, then we in the Web server to obtain the IP is not fully believe, then we should be what way to restrict the user real IP, or is it true this road is not feasible?

Nginx is "You" build, or "banned users" set up?

Http_x_forward_for can be forged, but remote_addr can't be changed.

If the "banned user" is built:
You can obtain the IP of the Nginx server by $_server["REMOTE_ADDR"), and seal directly.

If it is the "you" built Nginx:
Although it is possible to obtain the user's IP by $_server["Http_x_forward_for", it may be forged.

proxy_set_header X-Forward-For $remote_addr

The best way is to increase the private HTTP header, Nginx forwarding when the private HTTP header X-gagaga (quack, guess not), using $_server["Http_x_gagaga"] to obtain, so attack this even if Xiang forged, do not know what to forge.

proxy_set_header X-GAGAGA $remote_addr

In addition, Ali's WW now Queen's agent platform HL System because http_x_forward_for filter is not strict, elaborate construction request can inject ... (now the new version has been repaired)

With regard to forgery, if you use the LINUX/UNIX/OSX, your own curl can be implemented:

curl abc.com/test.php -H "X-FORWARD-FOR:8.8.8.8"

If not filtered, there happens to be directly through the IP to determine whether the blacklist or the background has the ability to record IP operations log:

#想注入就注入curl miaoqiyuan.cn/test.php -H "X-FORWARD-FOR:' or 'a'='a"#想XSS就XSScurl miaoqiyuan.cn/test.php -H "X-FORWARD-FOR:alert('a')"

I thought of a solution, you can configure Nginx, add Proxy_set_header x-forward-for $remote _addr configuration. Then $_server["Http_x_forward_for"] to obtain the user's real IP, and then the program inside the IP restrictions.

