Preventing IP spoofing

Question

If I throw both of these two into a database, is that enough to prevent a site visitor from spoofing that they are coming from a different IP address?

$ip1 = $_SERVER['HTTP_X_FORWARDED_FOR'];
$ip2 = $_SERVER['REMOTE_ADDR'];

Answer 1

Short answer - no. You can never guarantee a link between an IP and a person. For almost all practical purposes though, yes, that's good enough.

Unless you're really expecting someone to go to significant lengths to hide their IP, you should be fine.

It really depends on what you're trying to do as to whether it's good enough or not.

Edit: Just seen your comment on the first post. An option for that is to look at Evercookies - they're extremely invasive and unethical, but they do do a very good job, so it's your call.

Answer 2

HTTP_X_FORWARDED_FOR is an HTTP header, so it can be easily spoofed. REMOTE_ADDR is an environment variable provided by the web server as specified in the CGI specification. It can't be easily spoofed. So there's no real point in caching either one.

If someone is spoofing the HTTP_X_FORWARDED_FOR header using a compromised proxy server, then there's not much you can do about that.

However, it should be easier to trust that a non-proxied request isn't spoofed since, unless the attacker is on the same subnet, they're limited to a blind spoofing attack, which requires them to guess the sequence and acknowledge numbers of the TCP connection. This is very difficult to do on modern networks. And even if they managed to do this, they wouldn't be able to receive any data routed to the spoofed IP, so it would be easy to filter out any blind spoofing attacks.

These days, it's not really possible (ok, nothing is impossible, but it does require very specific circumstances and has limited applications) for someone to actually use a spoofed IP to make an anonymous TCP connection to a web server. At most packet spoofing is used for DDoS and flood attacks.

Answer 3

Nope, it's very easy to spoof X-FORWARDED-FOR, which is literally sent as a header. Try making an account system or have it rely on email or something. You cannot trust IP alone.

Given your above comment, $_SERVER['REMOTE_ADDR'] will most likely suffice since they'd have to change IPs every time they wanted to perform that action, which would involve proxying or most likely Tor.