What limitations are there in using X-FORWARDED-FOR headers to detect proxies in PHP?

Using X-FORWARDED-FOR headers to detect proxies in PHP can be unreliable as they can easily be spoofed or modified by the client. To improve accuracy, you can check for multiple headers and validate the IP addresses to ensure they are in the correct format. Additionally, you can compare the client's IP address with the X-FORWARDED-FOR header to detect any inconsistencies. 

$proxy_headers = array(
    'HTTP_X_FORWARDED_FOR',
    'HTTP_X_FORWARDED',
    'HTTP_X_CLUSTER_CLIENT_IP',
    'HTTP_CLIENT_IP',
    'HTTP_FORWARDED_FOR',
    'HTTP_FORWARDED',
);

$ip_address = $_SERVER['REMOTE_ADDR'];

foreach ($proxy_headers as $header) {
    if (isset($_SERVER[$header])) {
        $ip_list = explode(',', $_SERVER[$header]);
        $client_ip = trim(end($ip_list));
        
        if (filter_var($client_ip, FILTER_VALIDATE_IP)) {
            if ($client_ip !== $ip_address) {
                echo 'Proxy detected!';
                break;
            }
        }
    }
}

Keywords

X-FORWARDED-FOR headers proxies limitations detection PHP

Related Questions