PHP Developers Network

I'm a bit confused by that last reply timvw.

You say that HTTP_ACCEPT_CHARSET isnt good to use, but it's from your own fingerprint function?

Or maybe it's just late.

After i read that HTTP_ACCEPT_CHARSET can change, i don't think it's a good idea to use. I admit that the code i wrote needs an update.

I use USER_AGENT and REMOTE_ADDR. If there is possibility that users will have different IP addresses during 1 session, I only use the first half of the address -> [104.54].234.99.
Maybe they change ip, but certainly not continent or state . So it's still partially locked to IP.

In case of IP switching between single requests in a session, I don't believe that the IP's highest two octets are gonna change. But even if they do - if you take only the first IP number, you're still protected from me, for example.

Forgot to mention; not sure, but I believe IE changes the ACCEPT headers. I've read it somewhere a while ago. Something about adjusting these headers to the document type in question or something, don't remember really. Be sure to check it out.

Most browsers also allow to change the UserAgent string etc..

It's a matter of choosing those variables you expect that are not going to change while they are using your webapplication. If a user decides to change his UserAgent string in a session anyway, he will need to login again...

I have a question for this old thread. Many of the responses here say never rely on IPs, but what if you can detect Proxy IPs. Wouldn't adding a non Proxy IP to one's fingerprint add extra security?

I read this thread:



And, I found this code, which is supposed to detect proxy IPs, although, I have no clue how reliable it is:

if (
$_SERVER['HTTP_X_FORWARDED_FOR']
|| $_SERVER['HTTP_X_FORWARDED']
|| $_SERVER['HTTP_FORWARDED_FOR']
|| $_SERVER['HTTP_CLIENT_IP']
|| $_SERVER['HTTP_VIA']
|| in_array($_SERVER['REMOTE_PORT'], array(8080,80,6588,8000,3128,553,554))
|| @fsockopen($_SERVER['REMOTE_ADDR'], 80, $errno, $errstr, 30))
{
exit('Proxy detected');
}

Hmm, I read this in regard to proxy headers:

"Highly anonymous proxies don’t add the abovementioned headers and can’t be detected with this technique."