CODEWITHSUNDEEP
phpapacheip-addressipv6ipv4
Alix Axel
Alix Axel

Reputation: 154553

REMOTE_ADDR and IPv6 in PHP

Is it safe to assume that $_SERVER['REMOTE_ADDR'] always returns a IPv4 address?

Thanks!

Upvotes: 21

Views: 12866

Answers (2)

Elliptical view
Elliptical view

Reputation: 3782

I have seen a bad IP address reported to php in REMOTE_ADDR from Apache 2.

It was '183.60..244.37'.

So the answer to your question, "Is it safe to assume...", I think is definitely no, REMOTE_ADDR can not be trusted.

As far as I know it is reported to PHP from the server, in my case Apache. Why it was bad I am still trying to figure out. I do know this. It came in as part of a batch of attack requests. Sometimes it was 183.60.244.37 and sometimes it was 183.60..244.37.

See also this.

Upvotes: 1

Michael Mrozek
Michael Mrozek

Reputation: 175395

The REMOTE_ADDR key is set by the web server, not PHP. If the web server listens on v6 and the user connects that way, it'll be a v6 address

Upvotes: 27

Related Questions