Can $_SERVER['REMOTE_ADDR'] be trusted?

Question

I have a website where only a couple of people can access it, so the number of IPs logged in is very limited. Everything submitted by the 'admins' logged in is sent to a specific folder dependent of their IP Address. Again they can't access the website through a proxy or anything because there's a limited range of IPs that is allowed.

Can I trust $_SERVER['REMOTE_ADDR'] to give a valid IP so the log-system would be 100 % stable and efficient ?

Answer 1

$_SERVER['REMOTE_ADDR'] cannot be modified by the user or via HTTP so you CAN trust it.

Answer 2

It's a basic rule that you should not trust the authenticity of a remote machine's apparent ip address for anything where forgery within the network could cause you real problems.

Secure systems authenticate not only the client to the server, but also the server to the client (to protect against impersonating the server to phish login credentials), typically using asymmetric cryptography.