$_SERVER['REMOTE_ADDR'] 可以信任吗？
我有一个网站，只有几个人可以访问，所以登录的IP数量非常有限。登录的“管理员”提交的所有内容都会发送到取决于其 IP 地址的特定文件夹。同样，他们无法通过代理或任何其他方式访问该网站，因为允许的 IP 范围有限。
我可以信任 $_SERVER['REMOTE_ADDR'] 提供有效的 IP，以便日志系统 100% 稳定且高效吗？
I have a website where only a couple of people can access it, so the number of IPs logged in is very limited. Everything submitted by the 'admins' logged in is sent to a specific folder dependent of their IP Address. Again they can't access the website through a proxy or anything because there's a limited range of IPs that is allowed.
Can I trust $_SERVER['REMOTE_ADDR'] to give a valid IP so the log-system would be 100 % stable and efficient ?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
$_SERVER['REMOTE_ADDR']无法由用户或通过 HTTP 进行修改，因此您可以信任它。$_SERVER['REMOTE_ADDR']cannot be modified by the user or via HTTP so you CAN trust it.这是一条基本规则，您不应相信远程计算机的明显 IP 地址的真实性，因为网络中的伪造可能会给您带来真正的问题。
安全系统不仅对服务器的客户端进行身份验证，还对客户端的服务器进行身份验证（以防止冒充服务器进行网络钓鱼登录凭据），通常使用非对称加密。
It's a basic rule that you should not trust the authenticity of a remote machine's apparent ip address for anything where forgery within the network could cause you real problems.
Secure systems authenticate not only the client to the server, but also the server to the client (to protect against impersonating the server to phish login credentials), typically using asymmetric cryptography.