README

Installation

composer require slam/psr7-get-client-ip

Motivation & Usage

Knowing the client's IP is needed to distinguish between bad and good actors, and take appropriate countermeasures. In IPv4 protocol it's an easy job (or it should be https://adam-p.ca/blog/2022/03/x-forwarded-for/):

If the actor is good, you take its IPv4 and stick its session to it, so to mitigate session hijacking.
If the actor is bad, you ban its IPv4.

In IPv6 protocol it's a different story though: routers default implementation allow each client to choose and change their IP within the subnet, which is at least /64. Rate-limiting and banning must take this into consideration, see https://adam-p.ca/blog/2022/02/ipv6-rate-limiting/

The best approach is still in debate; this library takes the following approach:

If the actor is good, the full IPv6 ir returned
If the actor is bad, the /64 relative subnet is returned

$request = new ServerRequest([
    'REMOTE_ADDR' => '1.2.3.4',
]);

var_dump((new Psr7GetClientIp())->forGoodList($request));       // '1.2.3.4'
var_dump((new Psr7GetClientIp())->forNaughtyList($request));    // '1.2.3.4'

$request = new ServerRequest([
    'REMOTE_ADDR' => '2013:b0a7:5d31:fd03:7257:ae71:6cb9:8e1d',
]);

var_dump((new Psr7GetClientIp())->forGoodList($request));       // '2013:b0a7:5d31:fd03:7257:ae71:6cb9:8e1d'
var_dump((new Psr7GetClientIp())->forNaughtyList($request));    // '2013:b0a7:5d31:fd03::/64'

slam / psr7-get-client-ip

Maintainers

Details

README

Installation

Motivation & Usage