{"id":16390181,"url":"https://github.com/slamdunk/psr7-get-client-ip","last_synced_at":"2025-03-23T04:31:39.805Z","repository":{"id":187453119,"uuid":"676958539","full_name":"Slamdunk/psr7-get-client-ip","owner":"Slamdunk","description":null,"archived":false,"fork":false,"pushed_at":"2025-03-18T16:14:56.000Z","size":139,"stargazers_count":2,"open_issues_count":1,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-18T17:51:20.413Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Slamdunk.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":["Slamdunk"],"custom":"https://paypal.me/filippotessarotto"}},"created_at":"2023-08-10T12:07:34.000Z","updated_at":"2025-03-09T13:40:28.000Z","dependencies_parsed_at":"2024-03-28T18:30:31.582Z","dependency_job_id":"06a950a8-1c83-4155-813b-4370fd962567","html_url":"https://github.com/Slamdunk/psr7-get-client-ip","commit_stats":null,"previous_names":["slamdunk/psr7-get-client-ip"],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Slamdunk%2Fpsr7-get-client-ip","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Slamdunk%2Fpsr7-get-client-ip/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Slamdunk%2Fpsr7-get-client-ip/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Slamdunk%2Fpsr7-get-client-ip/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Slamdunk","download_url":"https://codeload.github.com/Slamdunk/psr7-get-client-ip/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245056889,"owners_count":20553855,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-11T04:35:10.418Z","updated_at":"2025-03-23T04:31:39.497Z","avatar_url":"https://github.com/Slamdunk.png","language":"PHP","funding_links":["https://github.com/sponsors/Slamdunk","https://paypal.me/filippotessarotto"],"categories":[],"sub_categories":[],"readme":"# PSR-7 Get Client Ip for both IPv4 and IPv6\r\n\r\n[![Latest Stable Version](https://img.shields.io/packagist/v/slam/psr7-get-client-ip.svg)](https://packagist.org/packages/slam/psr7-get-client-ip)\r\n[![Downloads](https://img.shields.io/packagist/dt/slam/psr7-get-client-ip.svg)](https://packagist.org/packages/slam/psr7-get-client-ip)\r\n[![CI](https://github.com/Slamdunk/psr7-get-client-ip/actions/workflows/ci.yaml/badge.svg)](https://github.com/Slamdunk/psr7-get-client-ip/actions/workflows/ci.yaml)\r\n[![Infection MSI](https://img.shields.io/endpoint?style=flat\u0026url=https%3A%2F%2Fbadge-api.stryker-mutator.io%2Fgithub.com%2FSlamdunk%2Fpsr7-get-client-ip%2Fmaster)](https://dashboard.stryker-mutator.io/reports/github.com/Slamdunk/psr7-get-client-ip/master)\r\n\r\n## Installation\r\n\r\n`composer require slam/psr7-get-client-ip`\r\n\r\n## Motivation \u0026 Usage\r\n\r\nKnowing the client's IP is needed to distinguish between bad and good actors, and take appropriate countermeasures.\r\nIn IPv4 protocol it's an easy job (or it should be https://adam-p.ca/blog/2022/03/x-forwarded-for/):\r\n\r\n* If the actor is good, you take its IPv4 and stick its session to it, so to mitigate session hijacking.\r\n* If the actor is bad, you ban its IPv4.\r\n\r\nIn IPv6 protocol it's a different story though: routers default implementation allow each client to choose and change\r\ntheir IP within the subnet, which is at least `/64`. Rate-limiting and banning must take this into consideration, see\r\nhttps://adam-p.ca/blog/2022/02/ipv6-rate-limiting/\r\n\r\nThe best approach is still in debate; this library takes the following approach:\r\n\r\n* If the actor is good, the full IPv6 ir returned\r\n* If the actor is bad, the `/64` relative subnet is returned\r\n\r\n```php\r\n$request = new ServerRequest([\r\n    'REMOTE_ADDR' =\u003e '1.2.3.4',\r\n]);\r\n\r\nvar_dump((new Psr7GetClientIp())-\u003eforGoodList($request));       // '1.2.3.4'\r\nvar_dump((new Psr7GetClientIp())-\u003eforNaughtyList($request));    // '1.2.3.4'\r\n\r\n$request = new ServerRequest([\r\n    'REMOTE_ADDR' =\u003e '2013:b0a7:5d31:fd03:7257:ae71:6cb9:8e1d',\r\n]);\r\n\r\nvar_dump((new Psr7GetClientIp())-\u003eforGoodList($request));       // '2013:b0a7:5d31:fd03:7257:ae71:6cb9:8e1d'\r\nvar_dump((new Psr7GetClientIp())-\u003eforNaughtyList($request));    // '2013:b0a7:5d31:fd03::/64'\r\n```\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fslamdunk%2Fpsr7-get-client-ip","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fslamdunk%2Fpsr7-get-client-ip","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fslamdunk%2Fpsr7-get-client-ip/lists"}