Real IP addresses and their advantages and disadvantages Asp.net

Source: Internet
Author: User
Tags servervariables
Real IP addresses and their advantages and disadvantages Asp.net
Real IP addresses and their advantages and disadvantages Asp.net
Http://tech.aspxsoft.com/aspnet/2006-3-16/425.aspx

Real IP addresses and their advantages and disadvantages Asp.net
Author: flowerbin Source: Network

There are bugs in the so-called "getting real IP addresses" method on the Internet, but the multi-layer transparent proxy is not taken into account.

Most codes are similar:

String IPaddress = (httpcontext. Current. Request. servervariables ["http_x_forwarded_for"]! = NULL
& Httpcontext. Current. Request. servervariables ["http_x_forwarded_for"]! = String. Empty)
? Httpcontext. Current. Request. servervariables ["http_x_forwarded_for"]
: HttpContext. Current. Request. ServerVariables ["REMOTE_ADDR"];

In fact, the above Code only tries to use a layer-1 proxy with the user. if the user has a layer-2, layer-3 http_x_forwarded_for, the value is: "The real IP address of the Local Machine, layer-1 proxy IP address, layer-2 proxy IP address ,..... ", if the length of the IP field stored in your data is very small (15 bytes), the database reports an error.

In practice, there are few users who use multi-layer transparent proxy.

In other cases, more and more websites are using proxy acceleration. For example, Sina and SOHU news all use Squid as proxy and use multiple servers for traffic distribution. Squid itself is similar to a transparent proxy. It will send "HTTP_X_FORWARDED_FOR". HTTP_X_FORWARDED_FOR includes the customer's IP address. If the customer already uses a transparent proxy, the "HTTP_X_FORWARDED_FOR" obtained by the program includes two IP addresses. (I have encountered 3 IP addresses and 4 have not)

Therefore, to obtain the "real" IP address, you should also determine whether "," comma exists in "HTTP_X_FORWARDED_FOR" or whether the length is too long (more than 15 bytes of xxx. xxx ).

The Code should be as follows:

/** // <Summary>
/// Obtain the real IP address of the client. If a proxy exists, the first non-Intranet address is used.
/// By flower. B
/// </Summary>
Public static string IPaddress
{
Get
{
String result = string. empty;

Result = httpcontext. Current. Request. servervariables ["http_x_forwarded_for"];
If (result! = NULL & result! = String. Empty)
{
// A proxy may exist.
If (result. IndexOf (".") =-1) // No "." is definitely not in IPv4 format.
Result = null;
Else
{
If (result. IndexOf (",")! =-1)
{
// There are ",", and multiple proxies are estimated. Obtain the first IP address that is not an intranet IP address.
Result = result. Replace ("", ""). Replace ("'","");
String [] temparyip = result. Split (",;". ToCharArray ());
For (int I = 0; I <temparyip. Length; I ++)
{
If (Text. IsIPAddress (temparyip [I])
& Temparyip [I]. Substring (0, 3 )! = "10 ."
& Temparyip [I]. Substring (0, 7 )! = "192.168"
& Temparyip [I]. Substring (0, 7 )! = "172.16 .")
{
Return temparyip [I]; // locate an address that is not an intranet address
}
}
}
Else if (Text. IsIPAddress (result) // The proxy is in the IP Format.
Return result;
Else
Result = null; // the content in the proxy is not an IP address and the IP address is used.
}

}

String IpAddress = (HttpContext. Current. Request. ServerVariables ["HTTP_X_FORWARDED_FOR"]! = Null & HttpContext. Current. Request. ServerVariables ["HTTP_X_FORWARDED_FOR"]! = String. Empty )? HttpContext. Current. Request. ServerVariables ["HTTP_X_FORWARDED_FOR"]: HttpContext. Current. Request. ServerVariables ["REMOTE_ADDR"];



If (null = result | result = String. Empty)
Result = HttpContext. Current. Request. ServerVariables ["REMOTE_ADDR"];

If (result = null | result = String. Empty)
Result = HttpContext. Current. Request. UserHostAddress;

Return result;
}
}

Disadvantages of "http_x_forwarded_for.

Http_x_forwarded_for is part of the HTTP header and does not affect TCP communication. In other words, the client can actually send HTTP_X_FORWARDED_FOR any content, which is a counterfeit IP address. The simplest is the IP address record of the WEB program, which was originally intended to record the real IP address. Instead, it was cheated by hackers. When your application records the client's access IP address, denies or permits access from some IP addresses, error logs may occur, or even kill by mistake.

Therefore, the necessary security logs should record the complete "HTTP_X_FORWARDED_FOR" (at least 3*15 + 2 bytes are allocated to the fields in the database to record at least 3 IP addresses) and "REMOTE_ADDR ". It is also essential to check the IP Format of HTTP_X_FORWARDED_FOR.

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.