IpAddressRetriever
class IpAddressRetriever (View source)
Methods
__construct(array $server, IPAddressValidator|null $ipValidator = null, array|null $trustedProxies = null)
No description
string
getClientIp()
Get the client IP address.
Details
__construct(array $server, IPAddressValidator|null $ipValidator = null, array|null $trustedProxies = null)
No description
string
getClientIp()
Get the client IP address.
Forwarded-IP headers (Client-IP, X-Forwarded-For, X-Real-IP) are only honored when the immediate peer (REMOTE_ADDR) is a private/loopback address - i.e. a reverse proxy on the same host or internal network - or an explicitly configured trusted proxy (security.trusted_proxies). Direct-internet peers cannot be trusted to send accurate headers, so their values are ignored to prevent audit-log spoofing and per-IP rate-limit bypass.