Skip to main content
August 16, 2011
Question

proxy detection and cgi variables

  • August 16, 2011
  • 1 reply
  • 2473 views

Just want to ask you about something that is bothers me, For few weeks i have a strange situation for one of my projects for which my client insists that project should have a proxy detection mechanism in order to deny access to those visitors who's landing into website from behind a proxy server.

Theoretically i know how to handle this; parsing browser request headers values in searching for specific proxy headers like:

1. for normal transparent proxy it is enought that
HTTP_X_FORWARDED_FOR exists.
2. for anonymous and high-anonymous would be:
HTTP_X_FORWARDED_FOR, HTTP_VIA, HTTP_X_PROXY_ID

So, i put a proxy address in my browser and access a simple page that

only dumps cgi scope variables.

(<cfdump var="#cgi#" label="cgi variables" />

But, no luck. None of those values from above seems to show up althought i see that remote_addr shows me the ip of proxy server confirming me that i use a proxy.

So code like:

<cfif IsDefined("CGI.HTTP_X_FORWARDED_FOR") AND CGI.HTTP_X_FORWARDED_FOR NEQ ''>

  proxy detected

<cfelseif IsDefined("CGI.HTTP_VIA") AND CGI.HTTP_VIA NEQ ''>

high-anon proxy detected

<cfelse>

  you are clean

</cfif>

would not have any chance. I have used this simple line of code into ACF 7 MX (with apache 2.0.53 - mod_jrun20.so)  or into my laptop to ACF 9 developer edition ( with apache 1.3.41 mod-ssl / mod_jrun.so - calling page from another pc in the same network).

Funny thing is that a php page via normal apache vhost gives me those variables leading me to think that it might not be an apache problem or at least i can not see it.

srv#cat testp.php
<?php
if(isset($_SERVER['HTTP_X_FORWARDED_FOR']) ||
($_SERVER['HTTP_USER_AGENT']=='') || ($_SERVER['HTTP_VIA']!='')){

die("Don't use proxies, please.");

}

?>

am i missing something? those $_SERVER variables from php does have other corespondent into ACF ?

thanks very much for anybody time.

This topic has been closed for replies.

1 reply

Inspiring
August 17, 2011

The thing you're probably missing is how CGI variables are documented to work:

http://help.adobe.com/en_US/ColdFusion/9.0/CFMLRef/WSc3ff6d0ea77859461172e0811cbec22c24-7785.html

CFDUMP only dumps a fixed list of common CGI variables, and all CGI variables always return "true" for isDefined() and structKeyExists().  This is stupid, but it's the way CF has always been.

What you need to do is to test the LENGTH of the CGI variable you're thinking of using.

--

Adam

August 17, 2011

Hi, Adam

Thank you very much for your tip. I have tried as you have suggested but still no luck.

<cfif Len(cgi.HTTP_X_FORWARDED_FOR) NEQ 0>
        proxy detected
<cfelseif Len(cgi.HTTP_VIA) NEQ 0>
        anon proxy detected
<cfelseif Len(cgi.HTTP_CLIENT_IP) NEQ 0>
        anon proxy detected
<cfelseif Len(cgi.HTTP_PROXY_CONNECTION) NEQ 0>
        anon proxy detected
<cfelse>
        it is ok
</cfif>
<br /><br />
<cfoutput>
Len of cgi.HTTP_X_FORWARDED_FOR is: #Len(cgi.HTTP_X_FORWARDED_FOR)# - #Left(cgi.HTTP_X_FORWARDED_FOR, 15)#<br />
Len of cgi.HTTP_VIA is: #Len(cgi.HTTP_VIA)#  - #Left(cgi.HTTP_VIA, 10)#<br />
Len of cgi.HTTP_CLIENT_IP is: #Len(cgi.HTTP_CLIENT_IP)# - #Left(cgi.HTTP_CLIENT_IP, 15)#<br />
Len of cgi.HTTP_PROXY_CONNECTION is: #Len(cgi.HTTP_PROXY_CONNECTION)# - #Left(cgi.HTTP_PROXY_CONNECTION, 1)#<br />
</cfoutput>

I have put a print-screen of my test page at:

http://www.thinktwice.ro/cgitest.jpg

thanks

best regards

Inspiring
August 17, 2011

Dunno in that case mate, sorry.  I'm not too au fait with (or indeed "at all au fait with ~") the ins and outs of proxy servers and how CF's CGI variables are populated.

:-(

--

Adam