Need help with ip-address-middleware?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

akrabat
139 Stars 31 Forks Other 59 Commits 2 Opened issues

Description

PSR-7 Middleware that determines the client IP address and stores it as an ServerRequest attribute

Services available

!
?

Need anything else?

Contributors list

# 9,453
PHP
slim-fr...
openshi...
apache
29 commits
# 403,994
CSS
html-ed...
bbcode
PHP
4 commits
# 174,335
PHP
CSS
Shell
Compose...
4 commits
# 135,719
aura
framewo...
php7
depende...
1 commit
# 278,182
CSS
Django
Shell
graphit...
1 commit
# 268,739
PHP
slim-fr...
worksho...
phpstor...
1 commit
# 22,191
CSS
css-fra...
scss-fr...
memo
1 commit
# 131,297
TypeScr...
slack
aws-lam...
Serverl...
1 commit
# 4,855
PHP
Shell
slugify
Nette
1 commit

Client IP address middleware

PSR-15 Middleware that determines the client IP address and stores it as an

ServerRequest
attribute called
ip_address
. It optionally checks various common proxy headers and then falls back to
$_SERVER['REMOTE_ADDR']
.

Build status

Configuration

The constructor takes 4 parameters which can be used to configure this middleware.

Check proxy headers

Note that the proxy headers are only checked if the first parameter to the constructor is set to

true
. If set to false, then only
$_SERVER['REMOTE_ADDR']
is used.

Trusted Proxies

If you configure to check the proxy headers (first parameter is

true
), you have to provide an array of trusted proxies as the second parameter. When the array is empty, the proxy headers will always be evaluated which is not recommended. If the array is not empty, it must contain strings with IP addresses (wildcard
*
is allowed in any given part) or networks in CIDR-notation. One of them must match the
$_SERVER['REMOTE_ADDR']
variable in order to allow evaluating the proxy headers - otherwise the
REMOTE_ADDR
itself is returned.

Attribute name

By default, the name of the attribute is '

ip_address
'. This can be changed by the third constructor parameter.

Headers to inspect

By default, this middleware checks the 'Forwarded', 'X-Forwarded-For', 'X-Forwarded', 'X-Cluster-Client-Ip' and 'Client-Ip' headers. You can replace this list with your own using the fourth constructor parameter.

If you use the nginx, setrealip_from directive, then you should probably set this to:

$headersToInspect = [
    'X-Real-IP',
    'Forwarded',
    'X-Forwarded-For',
    'X-Forwarded',
    'X-Cluster-Client-Ip',
    'Client-Ip',
];

If you use CloudFlare, then according to the documentation you should probably set this to:

$headersToInspect = [
    'CF-Connecting-IP',
    'True-Client-IP',
    'Forwarded',
    'X-Forwarded-For',
    'X-Forwarded',
    'X-Cluster-Client-Ip',
    'Client-Ip',
];

Security considerations

A malicious client may send any header to your proxy, including any proxy headers, containing any IP address. If your proxy simply adds another IP address to the header, an attacker can send a fake IP. Make sure to setup your proxy in a way that removes any sent (and possibly faked) headers from the original request and replaces them with correct values (i.e. the currently used

REMOTE_ADDR
on the proxy server).

This library cannot by design ensure you get correct and trustworthy results if your network environment isn't setup properly.

Installation

composer require akrabat/ip-address-middleware

Usage

In Slim 3:

$checkProxyHeaders = true; // Note: Never trust the IP address for security processes!
$trustedProxies = ['10.0.0.1', '10.0.0.2']; // Note: Never trust the IP address for security processes!
$app->add(new RKA\Middleware\IpAddress($checkProxyHeaders, $trustedProxies));

$app->get('/', function ($request, $response, $args) { $ipAddress = $request->getAttribute('ip_address');

return $response;

});

In Laminas, add to your

pipeline.php
config at the correct stage, usually just before the
DispatchMiddleware
: ```php

config/pipeline.php

using default config

$app->add(RKA\Middleware\IpAddress::class); ```

Testing

  • Code style:
    $ vendor/bin/phpcs
  • Unit tests:
    $ vendor/bin/phpunit
  • Code coverage:
    $ vendor/bin/phpunit --coverage-html ./build

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.