$r->connection->remote_ip with proxy and non proxy env

[cfaust-dougot]

Folks,
 
I'm guessing this has been answered but I couldn't find it.
 
We need to do some IP checking and need to support it on both a load balanced 
environment and in a dedicated machine setup.
 
In the load balanced situation $r->connection->remote_ip returns 1 - Is that 
correct and consistent so I can use it to switch between how I get the IP 
address?
 
In other words should I be doing something like
 
if ($r->connection->remote_ip == 1)
  my $ip = $r->headers_in->{'X-Forwarded-For'}
} else {
  my $ip = $r->connection->remote_ip;
}
 
Or is there a better way?
 
TIA!
-Chris
 
 

Re: $r->connection->remote_ip with proxy and non proxy env

[Fred Moyer]

cfaust-dougot wrote:

Folks,
 
I'm guessing this has been answered but I couldn't find it.
 
We need to do some IP checking and need to support it on both a load 
balanced environment and in a dedicated machine setup.
 
In the load balanced situation $r->connection->remote_ip returns 1 - Is 
that correct and consistent so I can use it to switch between how I get 
the IP address?
 
In other words should I be doing something like
 
if ($r->connection->remote_ip == 1)

  my $ip = $r->headers_in->{'X-Forwarded-For'}
} else {
  my $ip = $r->connection->remote_ip;
}
 
Or is there a better way?


That seems like a good approach but I don't understand why 1 would be 
returned as the remote_ip.  Of course, you will want to scope 'my $ip 
outside of the conditional so that you can use it elsewhere.


You could also do something like:

if (my $ip = $r->headers_in->{'X-Forwarded-For'}) {

$r->connection->remote_ip( $ip );
}

 
TIA!

-Chris
 
 

Re: $r->connection->remote_ip with proxy and non proxy env

[Heiko Jansen]

Am Mittwoch, den 08.10.2008, 10:06 -0700 schrieb Fred Moyer:

> You could also do something like:
> 
> if (my $ip = $r->headers_in->{'X-Forwarded-For'}) {
> 
>  $r->connection->remote_ip( $ip );
> }

But (as I learned the hard way long ago) you should check the value of
the X-Forwarded-For header: On its way to you the request might have
passed other proxys which could also have contributed to that header
(putting anything in there from internal IPs to the string
"unknown"...).
IIRC, a frontend Apache proxy on your side appends (not prepends) the
remote ip it saw to the header (separated by ", ").

Heiko