PHP 取得用戶真實 IP 完整方案 (支援代理、CDN)

標準取得函數

function getClientIp(): string
{
    $headers = [
        'HTTP_CLIENT_IP',
        'HTTP_X_FORWARDED_FOR',
        'HTTP_X_FORWARDED',
        'HTTP_X_CLUSTER_CLIENT_IP',
        'HTTP_FORWARDED_FOR',
        'HTTP_FORWARDED',
        'REMOTE_ADDR'
    ];
    
    foreach ($headers as $header) {
        if (isset($_SERVER[$header])) {
            $ips = array_map('trim', explode(',', $_SERVER[$header]));
            foreach ($ips as $ip) {
                if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
                    return $ip;
                }
            }
        }
    }
    
    return $_SERVER['REMOTE_ADDR'] ?? 'unknown';
}

Header 來源說明

關鍵安全原則

1. 不可盲目信任 Header：用戶可偽造 X-Forwarded-For
2. 必須建立信任代理清單：僅接受已知 Load Balancer / CDN (Cloudflare, AWS ALB, Nginx 反向代理) 轉發的 Header
3. 過濾私有/保留 IP：10.x, 172.16-31.x, 192.168.x, 127.x, 169.254.x

框架整合範例 (Laravel / Symfony)

// Laravel: 設定 trusted proxies
// app/Http/Middleware/TrustProxies.php
protected $proxies = '*'; // 或具體 IP 陣列
protected $headers = Request::HEADER_X_FORWARDED_FOR | Request::HEADER_X_FORWARDED_HOST | Request::HEADER_X_FORWARDED_PORT | Request::HEADER_X_FORWARDED_PROTO;

// 控制器中直接使用
$ip = $request->ip(); // 自動處理信任代理

// Symfony: framework.yaml
framework:
    trusted_proxies: '192.168.0.0/16,10.0.0.0/8'
    trusted_headers: ['x-forwarded-for', 'x-forwarded-host']

Cloudflare 專用處理

if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) {
    // Cloudflare 保證真實性
    return $_SERVER['HTTP_CF_CONNECTING_IP'];
}

register_globals 相容代碼 (已棄用)

原文附有 register_globals=off 相容代碼，PHP 5.4+ 已移除此功能，現代專案無需處理。