如果IP地址可以被欺骗的话
如果可以通过创建虚假或被操纵的 http 标头来欺骗 IP 地址，因此不应依赖它来验证 PHP/ASP 页面中的传入请求，那么服务器为何会采用它并依赖它呢？比如拒绝IP或者允许IP都是基于IP的。
服务器是否可以通过其他（且更可靠）方式获取 IP 信息，而不是 PHP/ASP 通过服务器变量获取 IP 信息？
If IP addresses can be spoofed by creating false or manipulated http headers, and therefore it should not be relied upon in validating the incoming request in our PHP/ASP pages, how come servers take that and rely on it? For example, denying IPs or allowing them are all based on IP.
do servers get the IP information some other ( and more reliable ) way than say PHP/ASP gets it thru server variables?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
服务器通常愿意依赖连接的 IP 地址来获取低风险流量，因为设置 TCP 会话需要 三向握手。仅当数据包中的 IP 地址可路由并且某些计算机已准备好处理连接时，此握手才能成功。恶意路由器可以伪造 IP 地址，但一般来说，距离路由器任一端点越远，伪造连接就越困难，因此大多数人准备依赖它来进行低风险用途。 （例如，DNS 欺骗更有可能歪曲连接端点。）
高风险用户必须使用类似于 TLS、IPsec 或 CIPSO（罕见）用于验证连接端点，或者在较低层上构建用户身份验证以验证特定连接（OpenSSH）。
但是 TCP 会话的实际内容可以是任何内容 - 服务器不应依赖 TCP 会话的内容（例如 HTTP 标头）来如实报告 IP 地址或其他重要内容。
Servers are typically willing to rely upon the IP address of a connection for low-risk traffic because setting up a TCP session requires a three-way handshake. This handshake can only succeed if the IP address in the packets is routable and some machine is prepared to handle the connection. A rogue router could fake IP addresses but in general, it is more difficult to fake connections the further away from either endpoint the router is, so most people are prepared to rely on it for low-risk uses. (DNS spoofing is far more likely way to misrepresent a connection endpoint, for example.)
Higher-risk users must use something more like TLS, IPsec, or CIPSO (rare) to validate the connection end-point, or build user authentication onto the lower layers to authenticate specific connections (OpenSSH).
But the actual contents of the TCP session can be anything and everything -- and a server should not rely upon the contents of the TCP session (such as HTTP headers) to faithfully report IP addresses or anything else vital.
IP 地址不能被欺骗。服务器需要该地址来发送回复。
PHP 从服务器获取其 $_SERVER 全局的 IP 地址（变量名由此而来！），这决定了协议栈中较低层的地址。
编辑：
sarnold 提出了一个很好的观点，即原则上，人们可能会破坏路由表以误导流量。 （事实上，我相信几年前在亚洲的第 1 级路由器中曾发生过这样的事件。）因此，我应该澄清一下，我的评论“IP 地址不能被欺骗”是狭义的，旨在指出服务器变量将始终忠实地反映目标 IP。服务器边界之外发生的事情完全是另一回事。
IP addresses cannot be spoofed. The address is needed for the server to send a reply.
PHP gets the IP address for its $_SERVER global from the server (hence the variable name!), which determines the address from lower in the protocol stack.
EDIT:
sarnold makes a good point that, in principle, one could corrupt routing tables to misdirect traffic. (Indeed, I believe there was an incident of this in a Tier 1 router in Asia a couple years ago.) So I should clarify that my comment that "IP addresses cannot be spoofed" was narrowly tailored to point out that the server variables will always faithfully reflect the destination IP. What goes on beyond the the server's borders is another matter altogether.