Lack of interest Show proper IP when behind reverse-proxy

This suggestion has been closed automatically because it did not receive enough votes over an extended period of time. If you wish to see this, please search for an open suggestion and, if you don't find any, post a new one.

Rasmus Vind

Well-known member
Many people use reverse-proxies these days. Common types are Cloudflare, Varnish, Nginx. Reverse-proxies work just fine with XenForo, however, when looking at the IP log, you will find that ALL registered IPs are by your proxy and not your user.
Because of this, I suggest that we add an option to the Options page allowing you to look at the 'X-Forwarded-For' header stead of REMOTE_ADDR.

Basically, this would add a bit more logic to XenForo_Helper_Ip where it looks at $request->getServer('
HTTP_X_FORWARDED_FOR'] but only if the option was enabled.

I would like the option to exist because many people are not using proxies and if there is no proxy, people can fake their IP with this instead.

I could do this myself if XenForo_Helper_Ip was dynamically loaded like many other classes are. Sadly, it isn't :(.
Upvote 0
This suggestion has been closed. Votes are no longer accepted.
It may not be the HTTP_X_FORWARDED_FOR setting which needs to be changed though - it depends on server configuration.

It could be HTTP_CF_CONNECTING_IP, _SERVER['HTTP_X_REAL_IP'] or some other _SERVER value.

The best way to manage this is by editing the config,php file.
Adding the code to the src/config.php finally resolved the issue:
You really don't want to do that blindly (without validating the actual IP address the request is coming from). You should only do it if the request comes from known/trusted IPs.

Doing a swap like that allows anyone visiting your site to set the HTTP_X_FORWARDED_FOR header in their HTTP request to anything they want. So a user that is sufficiently technical enough to know how to set HTTP request headers could set the IP to anything they feel like.
I am running v2.2.13 and it works there by just pasting it into the config. After that the forum was also able toa ctually show how many visitors we have in the forum.
Top Bottom