title: How to use HTTP_X_FORWARDED_FOR properly?
body: <p>Alright, I have an small authentication issue. My web service allows to connect to my API over HTTP with a username and password, but this connection can also be restricted to a specific IP address.</p>
  
  <p>This means that the <code>$_SERVER['REMOTE_ADDR']</code> can be incorrect. I already know that any IP information can never truly be relied upon - I have the restriction only in an attempt to add another layer of security.</p>
  
  <p>If this is the general overview of a request to my web server:</p>
  
  <p><code>clientSERVER =&gt; clientPROXY =&gt; myPROXY =&gt; mySERVER</code></p>
  
  <p>Then this means that mySERVER shows <code>REMOTE_ADDR</code> of myPROXY instead of that of the client and sends the actual IP of the client as <code>HTTP_X_FORWARDED_FOR</code>.</p>
  
  <p>To overcome this, my web service has a list of 'trusted proxy' IP addresses and if <code>REMOTE_ADDR</code> is from one of those trusted IP addresses, then it tells my web service that the actual IP address is the value of <code>HTTP_X_FORWARDED_FOR</code>.</p>
  
  <p>Now the problem is with clientPROXY. This means that (quite often) mySERVER gets <code>HTTP_X_FORWARDED_FOR</code> value that has multiple IP addresses. According to <code>HTTP_X_FORWARDED_FOR</code> documentation, the value is a comma-separated list of IP addresses where the first IP is that of the actual true client and every other IP address is that of a proxy.</p>
  
  <p>So, if <code>HTTP_X_FORWARDED_FOR</code> has multiple values and my service is IP restricted, do I have to check the 'last' value of <code>HTTP_X_FORWARDED_FOR</code> against my allowed IP list and just ignore the actual client IP?</p>
  
  <p>I assume that in a system, where I have to set the list of allowed IP addresses, the whitelisted IP address should be that of a proxy and not an IP that is behind the proxy (since that could be some localhost IP and change frequently).</p>
  
  <p>And what of <code>HTTP_CLIENT_IP</code>?</p>