Skip to content

Method getClientIp in Request return wrong IP with a wrong x-forward-for  #15525

Closed
@skonsoft

Description

@skonsoft

Hello,

I pass through a proxy (Squid) which add a header 'X-Forwarded-For' with a wrong IP. So the 'X-Forwarded-For' contains 'unknown'.

I tried to get the Client IP from Request Object like this:

$ip = $this->request->getClientIp();

Here, i got 'uknown' as IP instead of getting the REMOTE_ADDR when the 'X-Forwarded-For' is not set or is not valid as described in SF Doc.

To fix this, i have to add a test:

$ip = $this->request->getClientIp();
if($ip == 'unknown'){
    $ip = $_SERVER['REMOTE_ADDR'];
}

This is not the right way to do it, but i need a result in production...

Perhaps, we should fix this in 'getClientIps' method by checking if IP is not valid, so we should use the Remote ADDR.

Symfony version: 2.7.2

Note that i trusted all proxies by adding this code in my front Controller:

Request::setTrustedProxies(array($request->server->get('REMOTE_ADDR')));

Tip: To reproduce this bug, you can use any HTTP/REST client and add 'X-Forwarded-For' header with any kind of bad values.

Thank you.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions