slam / psr7-get-client-ip

v1.5.0 2026-11-03 07:04 UTC

Requires

• php: ~8.5.0 || ~8.6.0
• psr/http-message: ^1.1 || ^2.0

Requires (Dev)

• infection/infection: ^0.35.9
• laminas/laminas-diactoros: ^3.9.0
• phpstan/phpstan: ^2.3.4
• phpstan/phpstan-phpunit: ^2.1.1
• phpunit/phpunit: ^13.4.6
• slam/php-cs-fixer-extensions: ^3.16.0

MIT

• Filippo Tessarotto

Published on Packagist.org on 2026-11-03 07:05 UTC

README

Installation

composer require slam/psr7-get-client-ip

Motivation & Usage

Knowing the client's IP is needed to distinguish between bad and good actors, and take appropriate countermeasures. In IPv4 protocol it's an easy job (or it should be https://adam-p.ca/blog/2022/03/x-forwarded-for/):

• If the actor is good, you take its IPv4 and stick its session to it, so to mitigate session hijacking.
• If the actor is bad, you ban its IPv4.

In IPv6 protocol it's a different story though: routers default implementation allow each client to choose and change their IP within the subnet, which is at least /64. Rate-limiting and banning must take this into consideration, see https://adam-p.ca/blog/2022/02/ipv6-rate-limiting/

The best approach is still in debate; this library takes the following approach:

• If the actor is good, the full IPv6 ir returned
• If the actor is bad, the /64 relative subnet is returned

$request = new ServerRequest([
    'REMOTE_ADDR' => '1.2.3.4',
]);

var_dump((new Psr7GetClientIp())->forGoodList($request));       // '1.2.3.4'
var_dump((new Psr7GetClientIp())->forNaughtyList($request));    // '1.2.3.4'

$request = new ServerRequest([
    'REMOTE_ADDR' => '2013:b0a7:5d31:fd03:7257:ae71:6cb9:8e1d',
]);

var_dump((new Psr7GetClientIp())->forGoodList($request));       // '2013:b0a7:5d31:fd03:7257:ae71:6cb9:8e1d'
var_dump((new Psr7GetClientIp())->forNaughtyList($request));    // '2013:b0a7:5d31:fd03::/64'