IpAddressRetriever
class IpAddressRetriever (View source)
Resolves the client IP from REMOTE_ADDR, honoring forwarded headers only from private or trusted proxy peers.
Constants
| private HEADERS_BY_MODE |
Forwarded headers read for each security.client_ip_header value; anything else reads as 'auto' |
Methods
No description
Build with security.trusted_proxies and security.client_ip_header.
Get the client IP address.
Details
__construct(array $server, IPAddressValidator|null $ipValidator = null, array $trustedProxies = [], string $clientIpHeader = 'auto')
No description
static IpAddressRetriever
fromConfig(array $server, ConfigurationInterface $config, IPAddressValidator|null $ipValidator = null)
Build with security.trusted_proxies and security.client_ip_header.
string
getClientIp()
Get the client IP address.
Forwarded-IP headers (X-Forwarded-For, X-Real-IP) are only honored when the immediate peer (REMOTE_ADDR) is a private/loopback address - i.e. a reverse proxy on the same host or internal network - or an explicitly configured trusted proxy (security.trusted_proxies). Direct-internet peers cannot be trusted to send accurate headers, so their values are ignored to prevent audit-log spoofing and per-IP rate-limit bypass.