��ȷ��remote_addr��x_forwarded_for

�� ߣ�� ʱ�䣺2013-12-26 | ��壺�� С��

[��]��վʱ��õ�remote_addr��x_forwarded_for��ͷ��Ϣ��ȡ�ͻ��˵�IP��Ȼ��з��CDN��£��ֵ�Ͳ��׼ȷ�ˣ��Ҫ��һЩ��á�ʲô��remote_addrremote_addr��ͻ��˵�IP��ֵ...

��վʱ��õ�remote_addr��x_forwarded_for��ͷ��Ϣ��ȡ�ͻ��˵�IP��Ȼ��з��CDN��£��ֵ�Ͳ��׼ȷ�ˣ��Ҫ��һЩ��á�

ʲô��remote_addr

remote_addr��ͻ��˵�IP��ֵ��ɿͻ��ṩ�ģ��Ƿ��˸��ݿͻ��˵�ipָ��ģ��ĳ��վʱ��м�û��κδ��ô��վ��web��Nginx��Apache�ȣ��ͻ��remote_addr��Ϊ��Ļ��IP��ĳ��ô��ȷ��Ȼ��ת��վ��web��ͻ��remote_addr��Ϊ��̨��IP��

ʲô��x_forwarded_for

��ʹ��˴��ʱ��web��Ͳ�֪��ʵIP�ˣ�Ϊ�˱��ͨ��һ��x_forwarded_for��ͷ��Ϣ��Ŀͻ��IP��IP��ӵ��ͷ��Ϣ���ܱ�֤��վ��web��ܻ�ȡ��ʵIP

ʹ��HAProxy��

ͨ��վΪ��֧�Ÿ��ķ��Ӻܶ�web��Щ��ǰ��һ��HAProxy��԰Ѹ��ؾ��ȵķֲ��Щ��ϡ��ʵ��̨��ٰ��ת��web��ʹ��web��remote_addr��Ϊ��̨��IP��Ϊ��ĳ��ȡ��ʵ�Ŀͻ��IP��Ҫ��HAProxy��

option forwardfor

��þ��˵�ģ��һ��x_forwarded_for��ͷ��Ϣ��ip��ӽ�ȥ

ʹ��Nginx��realipģ��

��Nginx��HAProxy��ʱ��ͻ��remote_addr��ΪHAProxy��IP��ֵ��ʵ�Ǻ��ģ��ͨ��nginx��realipģ�飬��ʹ��x_forwarded_for��ֵ��ʹ��ģ��Ҫ��±��Nginx��--with-http_realip_module��

set_real_ip_from   10.1.10.0/24;
real_ip_header     X-Forwarded-For;

��þ��ǰѴ�10.1.10��һ��ι��ȫ��ʹ��X-Forwarded-For��ͷ��Ϣ��Ϊremote_addr

��Nginx��HAProxyǰ��HTTPS��

��վΪ�˰�ȫ��ͨ��ʹ��https��Ϣ��httpsʹ��ssl��ܣ�HAProxyû��ֱ�ӽ��Ҫ��HAProxyǰ��ȼ�̨Nginx��ܣ��ת��HAProxy��ؾ��⡣��Web��ǰ��ʹ��Ϊ��ȡ��ʵ�Ŀͻ��IP��Ҫ��á�

��Ҫ��Nginx�Ĵ��趨

proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;

��Nginx��https��x_forwarded_forͷ��Ϣ��ͻ��ʵIP��

��޸�HAProxy��

option     forwardfor except 10.1.10.0/24

��ú�֮ǰ�趨�Ĳ�ֻ࣬�Ƕ��˸��IP�Σ��ʾ��HAProxy�յ��Ļ��https��Ͳ��趨x_forwarded_for��ֵ��֤��web��õ��ľ��ǰ��https��ġ�

ΪʲôPHP��HTTP_X_FORWARDED_FOR��Nginx�Ĳ�һ��

��վʹ��CDN��û��ȷ��CDN��CDNû�л��棬��Դվ��ķ��ȡ��ݡ�CDN�ڻ�Դվʱ��x_forwarded_forͷ��Ϣ��û��ʵIP��ķ��Ҳ��趨��ֵ��Ḳ�ǣ��ǰ�CDN��IP��ǰremote_addr��ӵ�x_forwarded_for�ĺ��棬��x_forwarded_for��ͻ��ֵ��Nginx��ʹ��Щֵ��ĵ�һ��ͻ��ʵIP��PHP��ʹ�õڶ��CDN�ĵ�ַ��Ϊ��PHPҲʹ�õ�һ��ֵ��Ҫ��fastcgi��á�

fastcgi_param HTTP_X_FORWARDED_FOR $http_x_forwarded_for;

��nginxʹ�õ�ֵ��һ��IP��PHP��PHP�õ��x_forwarded_for��ʵ��ֻ��һ��ֵ�ˣ�Ҳ�Ͳ��õڶ��CDN��IP�ˡ�

��x_forwarded_for

��ʵ��ʹ��Nginx��realipģ��󣬾��Ѿ��֤��remote_addr��趨�ľ��ǿͻ��˵��ʵIP��ٿ��

set_real_ip_from   10.1.10.0/24;
real_ip_header     X-Forwarded-For;

��ǰ�x_forwarded_for��Ϊremote_addr��nginx��x_forwarded_forȡ�ľ��е�һ��IP��

ʹ��Щ��þ��ܱ�֤��remote_addr��趨��һֱ��ǿͻ��˵��ʵIP��x_forwarded_for��Ժ��:)

ԭ�ģ�http://blog.pengqi.me/2013/04/20/remote-addr-and-x-forwarded-for/

ת��ע��Դ��ITѧϰ�� ַ��http://www.t086.com/ ��Ƽ��
�ر�� վ��ر��ֹת�ص�ר��¿��ת�أ��ע��ԭʼ��ߡ��°�Ȩ��ԭʼ��С��ڱ��վת��µĸ��˺��վ��Ǳ�ʾ��л�⡣��վת�ص��а�Ȩ��ϵ��ǣ��ǻᾡ��Ը��