views:

417

answers:

2

I'm developing an application where it seems likely that people will attempt to hide what their client IP address is behind a proxy server.

Is there a unified way to get what the actual client IP Address is behind the proxy? Looking at the Ruby docs, it explicitly states that

request.remote_ip

and

request.remote_addr

both would return the proxy address and not the actual client IP and I'm thrown by the "may contain" descriptions in the rest of the HTTP headers.

+2  A: 

It depends if the proxy supports X-Forwarded-For. I'd run some tests to be sure that remote_ip isn't what you're looking for - based on a quick glance at the code it attempts to read the HTTP_X_FORWARDED_FOR header.

Andy Gaskell
If remote_ip is checking the "furthest" HTTP_X_FORWARDED_FOR then I don't have to worry about trying to sort that out myself. Thanks.
Mike Buckbee
+1  A: 

I'm typing this from a machine that's behind a proxy. I'm not "hiding", it's how my organisation (and most others large enough to have a server) works. I don't have a fixed IP address: it's allocated dynamically. So I can't see how knowing my "current" IP address is going to help, since it'll be different tomorrow. Heck, I may be connected via a different proxy tomorrow (I work for a large organisation)!

At home, I have several machines connected through a router. Again, I don't have a fixed IP address: it's allocated dynamically by my ISP. It's a large ISP, so there's probably a proxy server somewhere upstream.

So I think what you want is not technically possible. What kind of application would make it "likely that people will attempt to hide what their client IP address is" anyway? What problem are you trying to solve?

Mike Woodhouse
I'm creating an online voting application and want to take reasonable measures to prevent vote stuffing - checkout http://musicmachinery.com/2009/04/15/inside-the-precision-hack/ for a worst case scenario. I should probably have specified "Anonymous Proxy" in my original question as the examples you have listed (Corporate or Local NAT) are correct but manageable from my perspective.
Mike Buckbee