Laravel获取客户端IP，你的姿势对吗？

鍦↙aravel涓紝閫氬父浣跨敤Illuminate\Http\Request::ip()鏂规硶鏉ヨ幏鍙栧鎴风鐨処P鍦板潃銆備絾鏄紝鍦ㄦ煇浜涙儏鍐典笅锛屽畠寰楀埌鐨勭粨鏋滃彲鑳戒笉鏄綘鎵€鏈熸湜鐨勩€傝繖浜涙儏鍐靛寘鎷細鎮ㄧ殑搴旂敤绋嬪簭閮ㄧ讲鍦ㄨ礋杞藉潎琛″櫒鍚庨潰锛屾偍鐨勫簲鐢ㄧ▼搴忎娇鐢–DN鏉ュ姞閫熸偍鍦ㄥ叾浠栧弽鍚戜唬鐞嗗悗闈㈢殑搴旂敤绋嬪簭閮ㄧ讲銆傛垜鎬庢牱鎵嶈兘寰楀埌姝ｇ‘鐨処P锛熷湪Laravel涓彲浠ヤ娇鐢╢ideloper/proxy鎵╁睍鍖呮潵瑙ｅ喅锛堟湰鏂囧彧璁ㄨLaravel5.5鍙婁箣鍚庣増鏈殑鎯呭喌锛屽洜涓篖aravel浠庤繖涓増鏈紑濮嬮粯璁ら泦鎴愪簡鎵╁睍鍖咃級銆傚畠鎻愪緵浜嗕竴涓悕涓篈pp\Http\Middleware\TrustedProxies鐨勪腑闂翠欢锛屽彲浠ュ府鍔╂偍璁剧疆鍙俊浠ｇ悊銆傛瘮濡備綘鐨勮礋杞藉潎琛℃湇鍔″櫒鐨処P鏄?92.168.1.1锛岄偅涔堜綘鍙渶瑕佸湪$proxies灞炴€т腑閰嶇疆杩欎釜IP锛?***杩欎釜搴旂敤绋嬪簭鐨勫彲淇′唬鐞嗐€?*@vararray|string*/protected$proxies='192.168.1.1';鏈夋湅鍙嬩細闂紝鎴戠殑璐熻浇鍧囪　鏈嶅姟鍣↖P涓嶅浐瀹氭€庝箞鍔烇紙姣斿AWSELB锛夛紵杩欑鎯呭喌涔熸槸鍙互瑙ｅ喅鐨勶紝浣嗘槸闇€瑕侀潪甯歌皑鎱庛€傞鍏堬紝鎮ㄩ渶瑕佸皢鎮ㄧ殑搴旂敤绋嬪簭鏈嶅姟鍣ㄩ厤缃负涓嶅搷搴斾换浣曢潪璐熻浇骞宠　璇锋眰銆傝繖鏍峰仛鐨勭洰鐨勬槸涓轰簡涓ユ牸鎺у埗璇锋眰鐨勬潵婧愶紝淇濊瘉鎺ユ敹鍒扮殑璇锋眰鏄彲淇＄殑锛堟瘮濡傚彲浠ラ€氳繃鍦ˋWS涓缃畨鍏ㄧ粍鏉ュ疄鐜帮級銆傜劧鍚庡皢$proxies璁剧疆涓?锛岃〃绀哄缁堜俊浠绘潵鑷笂灞備唬鐞嗙殑浼犲叆璇锋眰銆傚綋鐒讹紝$proxies涔熷彲浠ユ槸涓€涓暟缁勩€傚鏋滀綘鏈夊灞傚弽鍚戜唬鐞嗭紝浣犻渶瑕侀厤缃涓狪P鍦板潃銆傝繖閲岀殑IP鍙互鏄疘Pv4涔熷彲浠ユ槸IPv6锛屽彲浠ヤ娇鐢–IDR鏍峰紡鐨処P鑼冨洿锛屾瘮濡傦細144.220.0.0/16銆傛垜鑷繁鎺ユ墜杩囦竴涓」鐩紝瀹冪殑鍙嶅悜浠ｇ悊姣斾笂闈㈢殑鎯呭喌瑕佸鏉傦細鎴戜滑鐨勫簲鐢ㄩ儴缃插湪澶氫釜AWS浜戞湇鍔″櫒瀹炰緥涓婏紝璐熻浇鐢盓LB鍧囪　銆傜敱浜庨」鐩湁鍏ㄥ眬璁块棶闇€姹傦紝鎴戜滑鍦‥LB鍓嶇涔熶娇鐢ㄤ簡CloudFront杩涜CDN鍔犻€熴€備笂闈㈣浜咵LB鐨処P鏄笉鍥哄畾鐨勶紝CloudFront鐨処P涔熸槸涓嶅浐瀹氱殑銆傞壌浜庤繖绉嶆儏鍐碉紝鎴戜滑鍙兘涓€涓€鍒嗘瀽銆傚浜嶦LB灞傦紝鎴戜滑浣跨敤鎺у埗璇锋眰婧愬苟灏?proxies璁剧疆涓?銆傝嚦浜嶤loudFront锛屽ソ鍦ˋWS涓哄紑鍙戣€呮彁渚涗簡CloudFront鑺傜偣鏈嶅姟鍣ㄧ殑IP鑼冨洿锛屾墍浠ユ垜浠彧闇€瑕佸皢瀹樼綉鎻愪緵鐨凜IDR淇℃伅閰嶇疆鍒?proxies灞炴€т腑鍗冲彲銆傚綋鐒讹紝CloudFront鐨処P鑼冨洿闅忔椂鍙兘鍙戠敓鍙樺寲锛屾墍浠ユ垜浠細瀹氭椂鎶撳彇鎺ュ彛骞剁紦瀛樼粨鏋滐紝浠ヤ繚璇佸噯纭€у拰鏁堢巼銆傚師鐞嗗湪浜嗚В浜嗗浣曟纭厤缃甌rustedProxies涔嬪悗锛屾垜浠渶瑕佸涔犲師鐞嗭紝鐭ュ叾鎵€浠ョ劧銆傚垎鏋怉pp\Http\Middleware\TrustedProxies鐨勬簮鐮佷笉闅惧彂鐜帮紝杩欎釜涓棿浠舵渶鍚庡仛鐨勪簨鎯呭氨鏄皟鐢⊿ymfony\Component\HttpFoundation::setTrustedProxies()鏂规硶灏嗕綘閰嶇疆鐨?proxies璧嬪€肩粰Symfony\杞埌Component\HttpFoundation绫荤殑$trustedProxies灞炴€с€傜湅鍒拌繖閲岋紝浣犲氨鏄庣櫧浜嗐€傚叾瀹炶繖涓姛鑳藉叾瀹炴槸鐢卞簳灞傜殑Symfony鎻愪緵鐨勩€俧ideloper/proxy鎵╁睍鍖呭彧鏄府鍔╅€傞厤Laravel锛圫ymfony鎿呴暱馃锛夈€傛帴涓嬫潵鍒嗘瀽婧愮爜锛屾墦寮€鏂囦欢vendor/symfony/http-foundation/Request.php锛岃鍙栬繖涓柟娉曪細publicfunctiongetClientIps(){$ip=$this->server->get('REMOTE_ADDR');濡傛灉(!$this->isFromTrustedProxy()){杩斿洖[$ip];}return$this->getTrustedValues(self::HEADER_X_FORWARDED_FOR,$ip)?:[$ip];}濡傛灉涓嶉厤缃甌rustedProxies鎴栬€呰繖涓緢瀹规槗鐞嗚В濡傛灉璇锋眰涓嶆槸鏉ヨ嚜鍙俊浠ｇ悊锛岄偅涔堢洿鎺ヨ繑鍥濺EMOTE_ADDR鍦板潃锛屾墍浠ユ棤娉曡幏鍙栧埌姝ｇ‘鐨処P銆傚鏋滆姹傛潵鑷彈淇′换鐨勪唬鐞嗭紝鍒欏鎴风鐨処P鏄粠X-Forwarded-For鏍囧ご涓幏鍙栫殑銆傞鍏堣鐭ラ亾REMOTE_ADDR锛屽畠鏄湇鍔″櫒锛坣ginx/apache锛変笌瀹㈡埛绔缓绔婽CP杩炴帴鏃跺緱鍒扮殑鐪熷疄瀹㈡埛绔湴鍧€锛屾棤娉曚吉閫犮€傛瘮濡備綘浣跨敤璐熻浇鍧囪　锛岄偅涔堝簲鐢ㄤ腑鑾峰彇鍒扮殑REMOTE_ADDR灏辨槸璐熻浇鍧囪　鏈嶅姟鍣ㄧ殑鍦板潃锛屽惁鍒欏氨鏄鎴风鐨勫湴鍧€銆傛墍浠sFromTrustedProxy()鏂规硶涔熸槸鏍规嵁REMOTE_ADDR鏉ュ垽鏂殑銆傜劧鍚庢槸X-Forwarded-For锛岃繖鏄疕TTP鍗忚涓父瑙佺殑鎵╁睍澶达紝鐢ㄤ簬璁板綍瀹㈡埛绔拰搴旂敤鏈嶅姟鍣ㄤ箣闂翠紶閫掔殑浠ｇ悊鏈嶅姟鍣ㄦ垨璐熻浇鍧囪　鍣ㄧ殑鍦板潃锛屽寘鎷鎴风鍦板潃銆傛牸寮忓涓嬶細X-Forwarded-For:client,proxy1,proxy2,proxy3姣忎釜浠ｇ悊鏈嶅姟鍣ㄩ兘浼氬湪杩欎釜header鍚庨潰杩藉姞涓婁竴涓唬鐞嗙殑鍦板潃锛屼篃灏辨槸鎴戜滑鍦╪ginx閰嶇疆鏂囦欢涓粡甯哥湅鍒扮殑Configuration:proxy_set_headerX-Forwarded-瀵逛簬$proxy_add_x_forwarded_for锛涙墍浠ユ兂瑕佽幏鍙栫湡姝ｇ殑瀹㈡埛绔疘P锛岄渶瑕侀€氳繃杩欎釜header鏉ヨ幏鍙栥€備絾闇€瑕佹敞鎰忕殑鏄紝X-Forwarded-For鏄彲浠ラ殢鎰忎吉閫犵殑銆傛瘮濡傛垜闅忔剰鏋勯€犱竴涓狧TTP璇锋眰锛?curl-H"X-Forwarded-For:192.168.1.1,192.168.1.2,192.168.1.3"鍥犱负杩欎釜https://example.com鐨勪吉閫狅紝鎴戜滑涓嶈兘鐩存帴浣跨敤X-Forwarded-For涓殑绗竴涓狪P浣滀负鏈€缁堢粨鏋溿€傚埆鎷呭績锛孲ymfony宸茬粡涓烘垜浠悶瀹氫簡杩欎竴鍒囥€傚叧浜嶴ymfony鐨勫叿浣撳仛娉曪紝鏈夊叴瓒ｇ殑鏈嬪弸鍙互鐩存帴鏌ョ湅getTrustedValues()鏂规硶鐨勬簮鐮併€傛垜绠€鍗曟弿杩颁竴涓嬭繃绋嬶細棣栧厛锛屼粠HTTP澶翠腑鍙栧嚭X-Forwarded-For鍜孎orwarded鐨勫€硷紝鐢熸垚涓€涓狪P鍒楄〃銆備负浠€涔堝湪杩欓噷浣跨敤Forwarded鏍囧ご锛熶簨瀹炰笂锛孹-Forwarded-For鐩墠涓嶅睘浜庝换浣曠幇鏈夎鑼冦€傝繖涓秷鎭ご鐨勬爣鍑嗙増鏈槸Forwarded锛屾牸寮忓涓嬶細Forwarded:by=;for=<鏍囪瘑绗?;涓绘満=<涓绘満>;proto=鑰孲ymfony鑰冭檻鍒颁簡涓ょheader鏍煎紡鐨勫鐞嗭紝浣嗘槸濡傛灉杩欎袱绉峢eader鍚屾椂瀛樺湪锛孲ymfony浼氭姏鍑哄啿绐佸紓甯搞€傛偍鍙互閫氳繃璁剧疆TrustedHeader鏉ュ垹闄ゅ叾涓竴涓互閬垮厤鍐茬獊寮傚父銆傝幏鍙朓P鍒楄〃鍚庯紝浣跨敤normalizeAndFilterClientIps()鏂规硶杩囨护鍑哄鎴风IP鍒楄〃銆俷ormalizeAndFilterClientIps()鏂规硶浼氫竴涓€鍒ゆ柇杈撳叆鐨処P鏄惁涓哄紑鍙戣€呴厤缃殑鍙俊IP锛屽鏋滄槸鍒欏皢鍏朵粠鍒楄〃涓Щ闄わ紝鍏朵綑涓哄鎴风IP鍒楄〃銆備絾鏈€閲嶈鐨勪竴鐐规槸锛宯ormalizeAndFilterClientIps()鏂规硶鍦ㄨ繑鍥炵粨鏋滄椂浼氳皟鐢╝rray_reverse()鏂规硶鏉ュ弽杞鎴风IP鍒楄〃銆傚ぇ瀹跺彲鑳戒細鏈夌枒闂紝涓轰粈涔堣鎶婄粨鏋滃€掑簭杩斿洖鍛紵鍗忚涓槑纭瀹氱涓€涓负鈥滅湡瀹炩€濆鎴风IP锛屼絾涔熸鏄繖绉嶅€掑簭淇濊瘉浜嗙粨鏋滅殑瀹夊叏鎬с€備妇涓緥瀛愭潵鐞嗚В锛氬亣璁炬垜浠湇鍔″櫒鐨勫弽鍚戜唬鐞嗛摼鏄繖鏍风殑锛?92.168.66.1->192.168.66.2->192.168.66.3锛屾渶鍚庝竴涓槸搴旂敤鏈嶅姟鍣↖P锛屾垜浠▼搴忎腑宸茬粡璁剧疆浜?92.168.66.1銆?92.168.66.2娣诲姞鍒板彈淇′换鐨勪唬鐞嗐€傝繖鏃讹紝涓€涓伓鎰忕敤鎴疯闂簡鎴戜滑鐨勭綉绔欍€備粬鐨勪富鏈篒P鏄?92.168.1.1銆傚綋浠栬闂垜浠殑绔欑偣鏃讹紝浠栨瀯閫犱簡X-Forwarded-For:$curl-H"X-Forwarded-For:192.168.1.3,192.168.1.2"https://example.com杩欎釜鎭舵剰璇锋眰鏈€缁堝埌杈句簡搴旂敤鏈嶅姟鍣ㄣ€俋-Forwarded-For鍏跺疄鏄繖鏍风殑锛歑-Forwarded-For:192.168.1.3,192.168.1.2,192.168.1.1,192.168.66.1绋嬪簭鍦╪ormalizeAndFilterClientIps()鏂规硶涓繃婊ゆ帀鍙俊浠ｇ悊IP鍚庯紝鍓╀笅鐨勭粨鏋滄槸锛?92.168.1.3銆?92.168.1.2銆?92.168.1.1銆傛樉鐒讹紝濡傛灉涓嶈繘琛岄€嗗簭澶勭悊锛屼娇鐢↖lluminate\Http\Request::ip()寰楀埌鐨処P鏄伓鎰忕敤鎴锋瀯閫犵殑192.168.1.3锛岄€嗗簭澶勭悊鍚庡緱鍒扮殑IP鎵嶆槸鐪熸鐨?92.168銆?.1.鎵€浠ヨ繖涓€掑簭寰堝叧閿€備簡瑙ｄ互涓婂師鍒欏悗锛屽嵆浣夸綘涓嶄娇鐢↙aravel鎴朣ymfony妗嗘灦锛屼綘涔熷彲浠ュ湪浣犵殑椤圭洰涓疄鐜版纭殑閫昏緫锛岃€屼笉鏄粠鏌愪釜閿欒鐨勪唬鐮佷腑鑾峰緱CV锛岃浣犵殑搴旂敤绋嬪簭闈复椋庨櫓銆傞厤缃枃浠舵湁浜涘紑鍙戣€呭枩娆㈠皢閰嶇疆缁熶竴鍒癱onfig/鐩綍涓嬶紝鑰屼笉鏄洿鎺ュ湪涓棿浠朵腑閰嶇疆銆傚彧闇€瑕佽繍琛屽涓嬪懡浠ゅ彂甯冮厤缃枃浠秚rustedproxies.php锛?phpartisanvendor:publish--provider="Fideloper\Proxy\TrustedProxyServiceProvider"褰撶劧濡傛灉浣犲鐜閰嶇疆鏈夐渶姹傦紝鍙互浣跨敤env()鏂规硶鑷鎵╁睍銆備絾璇锋敞鎰忥紝涓棿浠朵腑鐨?proxies灞炴€т紭鍏堜簬閰嶇疆鏂囦欢銆傚綋$proxies灞炴€ф湁鍊兼椂锛岄厤缃枃浠朵腑璁剧疆鐨勫€煎皢澶辨晥锛岃鍕胯俯韪忋€?/p>