Hello @itsanewday !
The IP address shown in the logs is the one to use, regardless of what the hosting company says. This is the IP address the remote website sees the incoming site has at the time the requests are received.
In theory, a server X has an IP address that identifies it to any destination.
In practice, when the server X sends a request on the network, it goes through multiple networking infrastructure devices before reaching its destination, and some of these devices are proxies ; proxies will mask the incoming IP address if they are encountered on the way, and change the REMOTE_ADDR
environment variable, and the destination will not be able to see server X’s IP address. So, even if this is the most reliable variable to determine the incoming IP, it may not be the one of the source itself.
One could imagine relying on HTTP_X_FORWARDED_FOR
environment variable would be a solution: that variable would contain the IP of server X in theory, and would seem more reliable. That would be wrong: HTTP_X_FORWARDED_FOR
is easy to spoof, and would introduce a big security risk.
It seems in your case the communication between the 2 servers goes through a proxy at some point, and it’s fine, you can use that IP – as indicated in the FAQ:
IP verification – IP addresses are verified using the REMOTE_ADDR server environment variable, which cannot be faked (unless the servers or the network infrastructure are already highly compromised, in which case there are bigger issues to worry about).
-
This reply was modified 4 years, 4 months ago by Alexandre Froger.
-
This reply was modified 4 years, 4 months ago by Alexandre Froger.
-
This reply was modified 4 years, 4 months ago by Alexandre Froger. Reason: typos and clarifying some points