[cfaussie] RE: cgi. variable for proxy??

[Simon Handfield]

>I think that "iif(NOT len(cgi.http_x_forwarded_for), DE(cgi.remote_addr), DE(listLast(cgi.http_x_forwarded_for)))" will do the trick >then. >Well, it will not be accurate but better than nothing, agree?   Yep it's up to you how much you want to rely on IPs, depending on how crucial it is that your business rules can't be circumvented.  Again, you can't account for clients who pass through a network device performing NAT.   I think you want to use listFirst() though, not listLast(). Subsequent proxies will add replaced IPs to the end of the list, not the beginning, so the first one in the list should be the client IP, or the closest you can get to it anyway.   :) s   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Taco Fleur Sent: Wednesday, 12 February 2003 13:21 To: CFAussie Mailing List Subject: [cfaussie] RE: cgi. variable for proxy?? Yikes!   > Hold on, you are syaing it could be a whole list of IPs in this variable?   yes, if an intial proxy server is configured to also refer requests to another proxy "further away" from the client, and the second proxy server is also non-transparent the second proxy server will add the first proxy server's IP to that of the client in http_x_forwarded_for.  so you would have:   remote_addr ==> [2nd proxy's IP] http_x_forwarded_for ==> [original client IP], [1st proxy's IP]   >I believe "iif(NOT len(cgi.http_x_forwarded_for), DE(cgi.remote_addr), DE(cgi.http_x_forwarded_for))" will take of the fact that >even if a proxy is used and it does not show me the ip it forwarded it for.   From my understanding, if requests pass through a transparent proxy http_x_forwarded_for is never populated, so you cannot assume, just because http_x_forwarded_for is a zero length string that the client's request hasn't been proxied.   Really all I want to do is the following (It will probably make more sense if I explain what I am trying to do). I have this Poll that people can take, once it is taken the client should not be able to take it again. Simple, we check for the cookie, but if the cookie is deleted they can take the poll again. Therefore I insert the "poll id" and "ip address" in a table, so if "cookie id" and "poll id" exist do not let the user take the poll again OR if the "ip address" and "poll id" exists do not let the user take the poll again.   since I was thinking about users using proxy's I figured I better handle that as well. So basically I just wanted to get at the clients ip address if its behind a proxy, if I can't then just insert the cgi.remote_addr   You might be thinking but that means once you accidently insert an address of a proxy X users cannot take the poll again, thats why I have a time out for the ip checking of 15 minutes.   I think that "iif(NOT len(cgi.http_x_forwarded_for), DE(cgi.remote_addr), DE(listLast(cgi.http_x_forwarded_for)))" will do the trick then. Well, it will not be accurate but better than nothing, agree?     In addition, if a client's request is behind a firewall or router using Network Address Translation, the IP address CF sees will not be that of the client.   I guess the short answer is, it depends what you want to use the IP for.   --- You are currently subscribed to cfaussie as: archive@mail-archive.com To unsubscribe send a blank email to [EMAIL PROTECTED] MX Downunder AsiaPac DevCon - http://mxdu.com/