To find the real user IP address in $_SERVER when proxies are involved, check trusted proxy headers like HTTP_CF_CONNECTING_IP, HTTP_X_REAL_IP, and HTTP_X_FORWARDED_FOR in order of preference. 2. Validate the IP format and ensure it is not from private or reserved ranges using filter_var with FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE, and FILTER_FLAG_NO_RES_LEN. 3. Only trust these headers if the request passes through a known and trusted proxy or CDN, as they can be spoofed. 4. Extract the leftmost IP from HTTP_X_FORWARDED_FOR if present, as it typically represents the original client. 5. Fall back to $_SERVER['REMOTE_ADDR'] if no valid proxy header is found. 6. Implement logging and monitoring for unexpected IP values and maintain a whitelist of trusted proxy IPs for added security. By following these steps, you can reliably determine the original client IP in a secure and accurate manner.

When working with PHP applications behind proxies or load balancers, accurately identifying the real user IP address can be tricky. The $_SERVER superglobal usually contains client and server information, but when traffic passes through intermediaries like reverse proxies or CDNs, the value of $_SERVER['REMOTE_ADDR'] may reflect the proxy’s IP instead of the original user.

So how do you find the real user IP address in $_SERVER when proxies are involved?

Understand the Common Proxy Headers

Proxies and load balancers often pass the original client IP through special HTTP headers. The most common ones are:

• HTTP_X_FORWARDED_FOR – A list of IP addresses indicating the chain of proxies the request passed through. The leftmost IP is typically the original client.
• HTTP_X_REAL_IP – Often used by reverse proxies like Nginx to pass the original client IP.
• HTTP_X_FORWARDED_HOST and HTTP_X_FORWARDED_PROTO – Not for IP detection, but often used in proxy setups.
• HTTP_CF_CONNECTING_IP – Used by Cloudflare.
• HTTP_TRUE_CLIENT_IP – Also used by Cloudflare in certain configurations.

These are accessible in PHP via $_SERVER keys (with HTTP_ prefix and uppercase, replacing hyphens with underscores).

Validate and Prioritize Trusted Headers

You should never blindly trust these headers, as they can be spoofed by malicious clients. Only rely on them if you're certain the request came through a trusted proxy (e.g., your own load balancer or CDN).

Here’s a practical approach:

function getUserIP() {
    // List of possible headers to check, in order of preference
    $headers = [
        'HTTP_CF_CONNECTING_IP',  // Cloudflare
        'HTTP_X_REAL_IP',         // Nginx or custom proxy
        'HTTP_X_FORWARDED_FOR',   // Most common proxy header
    ];

    foreach ($headers as $header) {
        if (!empty($_SERVER[$header])) {
            // Handle comma-separated list (common in X-Forwarded-For)
            $ips = array_map('trim', explode(',', $_SERVER[$header]));
            $ip = $ips[0]; // Take the leftmost IP (original client)

            // Validate IP format and ensure it's not private/reserved
            if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_LEN)) {
                return $ip;
            }
        }
    }

    // Fallback to REMOTE_ADDR if no valid proxy header found
    return $_SERVER['REMOTE_ADDR'] ?? 'unknown';
}

Key Considerations

• Security: Only trust proxy headers if your server is behind a known proxy. If clients can bypass the proxy, they could fake their IP by sending a forged X-Forwarded-For.
• Private IP Ranges: Avoid accepting IPs from private ranges (like 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) unless you're certain of your network setup.
• Multiple Proxies: In X-Forwarded-For, each proxy appends the IP. The full chain might look like: client, proxy1, proxy2. The first IP is the original client.
• CDN-Specific Headers: If using Cloudflare, Fastly, or AWS ELB, check their documentation for the correct headers they inject.

Final Thoughts

Finding the real user IP in $_SERVER when proxies are involved requires checking specific headers and validating their content. Always prioritize security over convenience—never assume headers are trustworthy unless you control the proxy layer.

Use a whitelist of trusted proxies, validate IP formats, and log unexpected values for monitoring. With proper handling, you can reliably extract the original client IP without compromising your application.

Basically, it’s not just about reading $_SERVER; it’s about knowing which keys to trust—and when.

The above is the detailed content of Navigating Proxies: Finding the Real User IP Address in $_SERVER. For more information, please follow other related articles on the PHP Chinese website!