CodeIgniter session behind proxy

Question

What happens when you don't have a list of proxy IPs? When using site acceleration services like Akamai, Google, Edgecast or CloudFront; it would always be hard to get IPs for sessions from them.

When testing our codeigniter application on a CDN, we noticed that IPs were being passed as CDN IPs and not the client IPs in the session database.

How can you get around to this?

    /*
|--------------------------------------------------------------------------
| Reverse Proxy IPs
|--------------------------------------------------------------------------
|
| If your server is behind a reverse proxy, you must whitelist the proxy IP
| addresses from which CodeIgniter should trust the HTTP_X_FORWARDED_FOR
| header in order to properly identify the visitor's IP address.
| Comma-delimited, e.g. '10.0.1.200,10.0.1.201'
|
*/
$config['proxy_ips'] = '';

Thanks!

Answer 1

Depending on the web server you use there are modules that will give you the true client IP address from the HTTP_X_FORWARDED_FOR header, or the equivalent for your proxy.

I use Nginx on my web server behind CloudFlare so I use this: http://wiki.nginx.org/HttpRealipModule

You'll need to configure the module for your web server that gets the real client IP from the correct header from your CDN.