Use Http_x_forwarded_for to get the serious consequences of client IP-related tips

In web development. We may all be accustomed to using the following code to obtain the client's IP address:
C # code

Copy Code code as follows:

Priority to get proxy IP
String IP = request.servervariables["Http_x_forwarded_for"];
if (string. IsNullOrEmpty (IP)) {
Direct access to client IP without proxy IP
IP = request.servervariables["REMOTE_ADDR"];
}

The code above looks normal. Unfortunately, there is a hidden danger!! Because the value of "http_x_forwarded_for" is obtained by obtaining the "x_forwarded_for" property of the HTTP header. So here's a way to provide a malicious attacker: can fake IP address!!
Here is the test code:

Copy Code code as follows:

HttpWebRequest request = (HttpWebRequest) httpwebrequest.create ("http://localhost/ip.aspx");
Request. Headers.add ("X_forwarded_for", "0.0.0.0");
HttpWebResponse response = (HttpWebResponse) request. GetResponse ();
StreamReader stream = new StreamReader (response. GetResponseStream ());
String IP = stream. ReadToEnd ();
Stream. Close ();
Response. Close ();
request = NULL;

"Ip.aspx" File code:

Copy Code code as follows:

Response.Clear ();
Priority to get proxy IP
String IP = request.servervariables["Http_x_forwarded_for"];
if (string. IsNullOrEmpty (IP))
{
Client IP is directly taken without proxy IP
IP = request.servervariables["REMOTE_ADDR"];
}
Response.Write (IP);
Response.End ();

So, when you access the Ip.aspx file in the test code. String IP = stream. ReadToEnd (); " The IP data that this code takes is "0.0.0.0"!!!! (Uh, in real life.) Such an IP address is definitely not the result we want. And in some voting systems to limit an IP only 1 votes, if it is similar to the code to obtain the other IP and then judge the words. Oh, the limit will fail.

Or if you use the above code to obtain the IP address and then no longer judge the data, perhaps further data destruction!!
For example, if you get an IP address in the code like the above, you have the SQL statement directly:
String sql = "INSERT into (IP) VALUE (' + IP + ')";
Then maybe the attacker can also do data destruction with SQL injection!!

So it seems that using the "Http_x_forwarded_for" attribute to obtain client IP is no longer desirable.-_-# But if you don't use this method. Then those who really used the proxy server. We can no longer obtain their real IP address (because some proxy servers will be "X_forwarded_for" This HTTP header plus access to the user's real IP address. Well, that's the way it is, something has got to be lost.

Finally, my advice is to stop using the above method to get the client IP. That is to ignore the agency. What about your advice???