Web-Server Security Guide

[cisla]

Be careful with PHP Firewall:

Code:

FUNCTION PHP_FIREWALL_get_ip() {
if ( PHP_FIREWALL_get_env('HTTP_X_FORWARDED_FOR') ) {
return PHP_FIREWALL_get_env('HTTP_X_FORWARDED_FOR');
} elseif ( PHP_FIREWALL_get_env('HTTP_CLIENT_IP') ) {
return PHP_FIREWALL_get_env('HTTP_CLIENT_IP');
} else {
return PHP_FIREWALL_get_env('REMOTE_ADDR');
}
}

The user can easilly change HTTP headers in the request, and put a fake IP, the best is to keep "REMOTE_ADDR". If the user use a proxy and you really want his real IP then keep both. Just keep in mind that the forwarded IP can be faked.

[Cryptography]

Be careful with PHP Firewall:

Code:

FUNCTION PHP_FIREWALL_get_ip() {
if ( PHP_FIREWALL_get_env('HTTP_X_FORWARDED_FOR') ) {
return PHP_FIREWALL_get_env('HTTP_X_FORWARDED_FOR');
} elseif ( PHP_FIREWALL_get_env('HTTP_CLIENT_IP') ) {
return PHP_FIREWALL_get_env('HTTP_CLIENT_IP');
} else {
return PHP_FIREWALL_get_env('REMOTE_ADDR');
}
}

The user can easilly change HTTP headers in the request, and put a fake IP, the best is to keep "REMOTE_ADDR". If the user use a proxy and you really want his real IP then keep both. Just keep in mind that the forwarded IP can be faked.

That's the only real problem with PHP-Firewall, other than that it's a pretty great tool to me.

[cisla]

Be careful with PHP Firewall:

Code:

FUNCTION PHP_FIREWALL_get_ip() {
if ( PHP_FIREWALL_get_env('HTTP_X_FORWARDED_FOR') ) {
return PHP_FIREWALL_get_env('HTTP_X_FORWARDED_FOR');
} elseif ( PHP_FIREWALL_get_env('HTTP_CLIENT_IP') ) {
return PHP_FIREWALL_get_env('HTTP_CLIENT_IP');
} else {
return PHP_FIREWALL_get_env('REMOTE_ADDR');
}
}

The user can easilly change HTTP headers in the request, and put a fake IP, the best is to keep "REMOTE_ADDR". If the user use a proxy and you really want his real IP then keep both. Just keep in mind that the forwarded IP can be faked.

That's the only real problem with PHP-Firewall, other than that it's a pretty great tool to me.

Yes I think so, good base to detect attacks I kept it in favorite for future usages.