[imp] X-Originating-IP

[Rich Lafferty]

On Mon, Feb 12, 2001 at 04:39:24PM +0000, Clive McDowell (c.mcdowell@qub.ac.uk) wrote:
> Folks,
> 
> adding the line -
> 
> X-Originating-IP: %REMOTE_ADDR%
> 
> to header.txt causes the ip source header to be displayed in messages
> generated using imp. The problem with this is that if a proxy cache 
> is used you get the cache address and not the client machine
> address.

If you get the "client address" by any method other than looking at
the address from which the http connection originated, then you're
looking at information provided *by* the client, which is to say,
entirely untrustable.

> I have heard it suggested that there is a variable called 
> HTTP_CLIENT_IP which will hold this information but using it instead 
> of REMOTE_ADDR does not work. Is there any way to get imp to add the 
> true client address rather than the cache address?

Not only is there no way, but there's also no way to determine what
the "true client address" is other than asking them and hoping they're
honest. If you're asking them and hoping they're honest, there's not
much point in taking note of their IP address in the first place. :-)

> The Queen's University of Belfast

Wow, we're all *over* the place! Neat. :-)

  -Rich

-- 
------------------------------ Rich Lafferty ---------------------------
 Sysadmin/Programmer, Instructional and Information Technology Services
   Concordia University, Montreal, QC                 (514) 848-7625
------------------------- rich@alcor.concordia.ca ----------------------