Reliably getting a web client IP

Question

What is the most reliable way of obtaining the IP address of a remote client connecting to your website? Some options I've looked into are:

• Server variables (such as REMOTE_ADDR in Apache), though this is usually the proxy address.
• A Java applet, but IE (at least the one I'm using) seems to deny it.

The only other thing I'm thinking about is having the client connect over HTTPS, in which case the proxy should be bypassed (generally speaking), and so REMOTE_ADDR would be accurate.

Any ideas?

Answer 1

Anything client-side (javascript, java) will give you the PCs IP address. Which could be an internal IP address like 10.0.0.1.

Re: SSL + REMOTE_ADDR, most workplace proxies send all the SSL through an application level proxy, SOME just allow 443 outbound. Any thing coming thru a proxy will still give you the proxy address, as the proxy is still the computer making the connection to your webserver.

Answer 2

HTTPS through a proxy is still a possibility, if the proxy is non-transparent (say, with a client on a corporate network). With HTTPS through a proxy, the REMOTE_ADDR will still be the proxy address - the proxy is still in the path, it just only gets to see the encrypted traffic.

If the client is going through a proxy, you'll have to rely on the proxy telling you their IP. The X-Forwarded-For header will contain this, but you can only really rely on this if you trust the proxy. If this is for logging purposes, log both REMOTE_ADDR and X-Forwarded-For. If it's for something else, you'll need to maintain a whitelist of proxies (as determined by REMOTE_ADDR) that you'll accept X-Forwarded-For from.