PHPackages                             acelaya/ip-address-middleware - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [HTTP & Networking](/categories/http)
4. /
5. acelaya/ip-address-middleware

Abandoned → [akrabat/ip-address-middleware](/?search=akrabat%2Fip-address-middleware)Library[HTTP & Networking](/categories/http)

acelaya/ip-address-middleware
=============================

Fork of http://github.com/akrabat/rka-ip-address-middleware with PHP 8.4 warnings fixed

v2.4.0(1y ago)0542BSD-3-ClausePHPPHP ^7.2 || ^8.0

Since Nov 24Pushed 1y agoCompare

[ Source](https://github.com/acelaya-forks/ip-address-middleware)[ Packagist](https://packagist.org/packages/acelaya/ip-address-middleware)[ Docs](http://github.com/akrabat/rka-ip-address-middleware)[ RSS](/packages/acelaya-ip-address-middleware/feed)WikiDiscussions main Synced today

READMEChangelogDependencies (6)Versions (2)Used By (0)

Client IP address middleware
============================

[](#client-ip-address-middleware)

PSR-15 Middleware that determines the client IP address and stores it as an `ServerRequest` attribute called `ip_address`. It optionally checks various common proxy headers and then falls back to `$_SERVER['REMOTE_ADDR']`.

[![Build status](https://camo.githubusercontent.com/73331733489976ebf8883cab6f07c02c4fe942b0f5c7b0d77428ca85fafd4557/68747470733a2f2f7365637572652e7472617669732d63692e6f72672f616b72616261742f69702d616464726573732d6d6964646c65776172652e7376673f6272616e63683d6d6173746572)](https://travis-ci.org/akrabat/ip-address-middleware)

Configuration
-------------

[](#configuration)

The constructor takes 4 parameters which can be used to configure this middleware.

**Check proxy headers**

Note that the proxy headers are only checked if the first parameter to the constructor is set to `true`. If it is set to `false`, then only `$_SERVER['REMOTE_ADDR']` is used.

**Trusted Proxies**

If you configure to check the proxy headers (first parameter is `true`), you have to provide an array of trusted proxies as the second parameter. When the array is empty, the proxy headers will always be evaluated which is not recommended. If the array is not empty, it must contain strings with IP addresses (wildcard `*` is allowed in any given part) or networks in CIDR-notation. One of them must match the `$_SERVER['REMOTE_ADDR']` variable in order to allow evaluating the proxy headers - otherwise the `REMOTE_ADDR` itself is returned.

**Attribute name**

By default, the name of the attribute is '`ip_address`'. This can be changed by the third constructor parameter.

**Headers to inspect**

By default, this middleware checks the 'Forwarded', 'X-Forwarded-For', 'X-Forwarded', 'X-Cluster-Client-Ip' and 'Client-Ip' headers. You can replace this list with your own using the fourth constructor parameter.

If you use the *nginx*, [set\_real\_ip\_from](http://nginx.org/en/docs/http/ngx_http_realip_module.html) directive, then you should probably set this to:

```
$headersToInspect = [
    'X-Real-IP',
    'Forwarded',
    'X-Forwarded-For',
    'X-Forwarded',
    'X-Cluster-Client-Ip',
    'Client-Ip',
];

```

If you use *CloudFlare*, then according to the [documentation](https://support.cloudflare.com/hc/en-us/articles/200170986-How-does-Cloudflare-handle-HTTP-Request-headers-) you should probably set this to:

```
$headersToInspect = [
    'CF-Connecting-IP',
    'True-Client-IP',
    'Forwarded',
    'X-Forwarded-For',
    'X-Forwarded',
    'X-Cluster-Client-Ip',
    'Client-Ip',
];

```

Security considerations
-----------------------

[](#security-considerations)

A malicious client may send any header to your proxy, including any proxy headers, containing any IP address. If your proxy simply adds another IP address to the header, an attacker can send a fake IP. Make sure to setup your proxy in a way that removes any sent (and possibly faked) headers from the original request and replaces them with correct values (i.e. the currently used `REMOTE_ADDR` on the proxy server).

This library cannot by design ensure you get correct and trustworthy results if your network environment isn't setup properly.

Installation
------------

[](#installation)

`composer require akrabat/ip-address-middleware`

In Mezzio, copy `Mezzio/config/ip_address.global.php.dist` into your Mezzio Application `config/autoload` directory as `ip_address.global.php`

Usage
-----

[](#usage)

In Slim 3:

```
$checkProxyHeaders = true; // Note: Never trust the IP address for security processes!
$trustedProxies = ['10.0.0.1', '10.0.0.2']; // Note: Never trust the IP address for security processes!
$app->add(new RKA\Middleware\IpAddress($checkProxyHeaders, $trustedProxies));

$app->get('/', function ($request, $response, $args) {
    $ipAddress = $request->getAttribute('ip_address');

    return $response;
});
```

In Laminas or Mezzio, add to your `pipeline.php` config at the correct stage, usually just before the `DispatchMiddleware`:

```
# config/pipeline.php
# using default config
$app->add(RKA\Middleware\IpAddress::class);
```

If required, update your `.env` file with the environmental variables found in `/config/autoload/ip_address.global.php`.

Testing
-------

[](#testing)

- Code style: `$ vendor/bin/phpcs`
- Unit tests: `$ vendor/bin/phpunit`
- Code coverage: `$ vendor/bin/phpunit --coverage-html ./build`

###  Health Score

29

—

LowBetter than 57% of packages

Maintenance36

Infrequent updates — may be unmaintained

Popularity14

Limited adoption so far

Community16

Small or concentrated contributor base

Maturity44

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 53.6% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

586d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/73480af83259e096d154a8c4333e550c186b28ccb7a0d11f537b9aa57ad35392?d=identicon)[acelaya](/maintainers/acelaya)

---

Top Contributors

[![akrabat](https://avatars.githubusercontent.com/u/33135?v=4)](https://github.com/akrabat "akrabat (60 commits)")[![kudashevs](https://avatars.githubusercontent.com/u/15892462?v=4)](https://github.com/kudashevs "kudashevs (23 commits)")[![aiglesiasn](https://avatars.githubusercontent.com/u/29462391?v=4)](https://github.com/aiglesiasn "aiglesiasn (6 commits)")[![acelaya](https://avatars.githubusercontent.com/u/2719332?v=4)](https://github.com/acelaya "acelaya (5 commits)")[![SvenRtbg](https://avatars.githubusercontent.com/u/416600?v=4)](https://github.com/SvenRtbg "SvenRtbg (4 commits)")[![batumibiz](https://avatars.githubusercontent.com/u/10770779?v=4)](https://github.com/batumibiz "batumibiz (4 commits)")[![gboily](https://avatars.githubusercontent.com/u/11210775?v=4)](https://github.com/gboily "gboily (1 commits)")[![GeeH](https://avatars.githubusercontent.com/u/613376?v=4)](https://github.com/GeeH "GeeH (1 commits)")[![harikt](https://avatars.githubusercontent.com/u/120454?v=4)](https://github.com/harikt "harikt (1 commits)")[![homeyjd](https://avatars.githubusercontent.com/u/1088185?v=4)](https://github.com/homeyjd "homeyjd (1 commits)")[![ElisDN](https://avatars.githubusercontent.com/u/1673552?v=4)](https://github.com/ElisDN "ElisDN (1 commits)")[![pascalheidmann-check24](https://avatars.githubusercontent.com/u/167064802?v=4)](https://github.com/pascalheidmann-check24 "pascalheidmann-check24 (1 commits)")[![pmous](https://avatars.githubusercontent.com/u/50670106?v=4)](https://github.com/pmous "pmous (1 commits)")[![satalaondrej](https://avatars.githubusercontent.com/u/40560686?v=4)](https://github.com/satalaondrej "satalaondrej (1 commits)")[![Seagull-4auKa](https://avatars.githubusercontent.com/u/3746956?v=4)](https://github.com/Seagull-4auKa "Seagull-4auKa (1 commits)")[![BafS](https://avatars.githubusercontent.com/u/588205?v=4)](https://github.com/BafS "BafS (1 commits)")

---

Tags

middlewarepsr7IP

###  Code Quality

TestsPHPUnit

Code StylePHP\_CodeSniffer

### Embed Badge

![Health badge](/badges/acelaya-ip-address-middleware/health.svg)

```
[![Health](https://phpackages.com/badges/acelaya-ip-address-middleware/health.svg)](https://phpackages.com/packages/acelaya-ip-address-middleware)
```

###  Alternatives

[symfony/symfony

The Symfony PHP framework

31.4k87.2M2.2k](/packages/symfony-symfony)[cakephp/cakephp

The CakePHP framework

8.9k19.5M1.8k](/packages/cakephp-cakephp)[mezzio/mezzio

PSR-15 Middleware Microframework

3923.8M125](/packages/mezzio-mezzio)[typo3/cms

TYPO3 CMS is a free open source Content Management Framework initially created by Kasper Skaarhoj and licensed under GNU/GPL.

1.2k1.9M122](/packages/typo3-cms)[tempest/framework

The PHP framework that gets out of your way.

2.2k34.4k15](/packages/tempest-framework)[moonshine/moonshine

Laravel administration panel

1.3k253.1k81](/packages/moonshine-moonshine)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)