CODEWITHSUNDEEP
phpsecuritycurl
TMH
TMH

Reputation: 6246

Is this code safe against being run from another server

I'll explain the setup quickly, we have multiple domains, running on 2 servers (Dev and Live), which all are populated from a CMS database on the Live server. I'm adding in 404 reporting, so each site logs any 404's it gets, and we can view them in the CMS.

Each site, when our Framework detects a 404 error, it does a curl call to http://cms.example.com/log404.php and sends the $_SERVER variable. At the top of the log404.php I have this code which wraps the whole logging code.

if (in_array($_SERVER['REMOTE_ADDR'], array('dev server ip', 'live server ip'))) {

Then in here I store the relevant bits of data from $_POST. The reason I did it this way, rather than each site just directly adding to the database, was if we want to change the logging code somehow (log different data, write it a file, change the database etc), it only needs changing once, rather than in 15+ different sites.

Is the above if statement a safe way to check if the data was posted by us, and not somebody else? Or would it be possible for somebody to manipulate the curl call so the REMOTE_ADDR appears to be one of our IP's?

Upvotes: 0

Views: 76

Answers (1)

SilverlightFox
SilverlightFox

Reputation: 33588

$_SERVER['REMOTE_ADDR'] uses the IP address from the TCP handshake so the same answer as this applies: Is it possible to pass TCP handshake with spoofed IP address?.

So if this is over the internet, then you are safe from the IP being spoofed.

However, for extra protection you should also protect your log service with authentication (as @moonwave99 suggested) and you should only run your log service over a HTTPS connection.

Upvotes: 1

Related Questions