ip.php library

Path in the Gestor bibliotecas/ip.php

Two functions: ip_get() finds the visitor's IP and ip_check() validates an address. The returned IP feeds the per-IP limits of login, sign-up, forms and OAuth2 (acessos-*, formularios-* in global variables).

It is not loaded by default: request ip in the module JSON or use gestor_incluir_biblioteca('ip'). The autenticacao, usuario, formulario and oauth2 libraries already use it.

ip_get($allow_private = false)

In order:

1. With SERVER_NAME equal to localhost, it returns REMOTE_ADDR directly (local environment).

2. If REMOTE_ADDR is a valid public IP, it returns it. Proxy headers are ignored.

3. Otherwise (the request came from a proxy on the private network, such as Nginx or a container), it walks X-Forwarded-For from right to left and returns the first valid public IP.

4. Nothing found: null.

Reading the chain from the right prevents the visitor from forging the IP by sending their own X-Forwarded-For: the rightmost value is the one your proxy appended.

127.0.0.1 is in the trusted proxy list and is never returned by steps 2 and 3. The list and the header (HTTP_X_FORWARDED_FOR) are hard-coded.

ip_check($ip, $allow_private = false, $proxy_ip = [])

true if $ip is a valid IPv4 or IPv6 address outside the reserved ranges (loopback included) and, without $allow_private, outside the private ranges (10/8, 172.16/12, 192.168/16, fc00::/7). An IP present in $proxy_ip is always false.

Functions

ip_check(string $ip, bool $allow_private = false, array $proxy_ip = []): bool

ip_get(bool $allow_private = false): string|null