Question

I am mediating requests from client A to server B. Client A may be a phone or a laptop computer. Server B wants to know client A’s IP address, but they are looking for it in $_SERVER['REMOTE_ADDR']. Because I am hitting server B, they are getting the “wrong” value for $_SERVER['REMOTE_ADDR'] — they’re getting my servers’ IP addresses. What can I do on my side so that server B will see the client’s IP address when they access $_SERVER['REMOTE_ADDR'] at their endpoint?

Answer 1

This is happening at a layer that cannot be overridden by your PHP script. The X-Forwarded-For header exists to relay the true client IP, but the remote server must support this easily-spoofed value.

$header = "X-Forwarded-For: {$_SERVER['REMOTE_ADDR']}, {$_SERVER['SERVER_ADDR']}";
curl_setopt($curl_handle, CURLOPT_HTTPHEADER, array($header));