From 5e731d5d11c483212849894601405815b71feb9d Mon Sep 17 00:00:00 2001 From: Andy Dixon Date: Sat, 12 Sep 2026 19:21:13 +0100 Subject: [PATCH] Report the client IP nginx forwards, not the Docker bridge REMOTE_ADDR inside the container is 172.17.0.1. When the peer is a private or loopback address, use X-Real-IP (or the first hop of X-Forwarded-For) that nginx sets. Public peers cannot spoof it. --- index.php | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/index.php b/index.php index 50c1934..b4a56ea 100755 --- a/index.php +++ b/index.php @@ -62,6 +62,14 @@ $dateReceived = date('Y-m-d H:i:s'); // Retrieve the IP address of the client making the request // Note: This may be a proxy IP if behind a load balancer or CDN $ipAddress = $_SERVER['REMOTE_ADDR'] ?? 'Unknown'; +// Behind nginx the peer is the Docker bridge; use the address nginx forwards. +// Only trust the proxy headers when the peer itself is a private/loopback address. +if (!filter_var($ipAddress, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) { + $forwarded = $_SERVER['HTTP_X_REAL_IP'] ?? trim(explode(',', $_SERVER['HTTP_X_FORWARDED_FOR'] ?? '')[0]); + if (filter_var($forwarded, FILTER_VALIDATE_IP)) { + $ipAddress = $forwarded; + } +} // Capture the HTTP method used for this request (GET, POST, PUT, DELETE, etc.) $requestMethod = $_SERVER['REQUEST_METHOD'] ?? 'Unknown';