Tuesday 15 January 2013

php - How secure is to assume that if $_SERVER['SERVER_ADDR'] === $_SERVER['REMOTE_ADDR'], is the server the one making the request? -


Well, the question says all this, I'm thinking, how safe the comparison is:

 < Code> if ($ _SERVER ['SERVER_ADDR'] === $ _SERVER ['REMOTE_ADDR']) {// Yes, this is the server, proceed to it. }   

I'm asking that the reason is to identify some web API calls coming from the server itself

I know that $ _ SERVER ['REMOTE_ADDR'] can be deceived to run a request but it can not be withdrawn if it is the case, for example, while talking about the rest, for example For this, this is not a problem for GET requests, but how to delete the request, where to the server There is no need to parse the reaction.
If the above description is correct, does it mean that you should not believe in comparison to the latter?
What are the options (let's get out of CLI from here)?

The best solution is using a secure password.

You will not have to worry about fake IP addresses or other unsafe probes, unless your password is only allowed in the correct password.

  If using ($ _GET ['password'] === 'my_password') {// code}   

to avoid timing attacks Consider it .

No comments:

Post a Comment