{"issue":{"milestone":null,"user":{"id":1269476,"login":"TobiHub","url":"https://api.github.com/users/TobiHub","avatar_url":"https://secure.gravatar.com/avatar/ed208705d735c060db509a0c7cac26a8?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","gravatar_id":"ed208705d735c060db509a0c7cac26a8"},"title":"Use $_SERVER['HTTP_X_FORWARDED_FOR'] if available!","created_at":"2011-12-17T12:48:04Z","updated_at":"2011-12-17T15:02:37Z","labels":[],"state":"open","id":2588709,"pull_request":{"patch_url":"https://github.com/WoltLab/WCF/pull/304.patch","html_url":"https://github.com/WoltLab/WCF/pull/304","diff_url":"https://github.com/WoltLab/WCF/pull/304.diff"},"html_url":"https://github.com/WoltLab/WCF/issues/304","closed_at":null,"body":"$_SERVER['HTTP_X_FORWARDED_FOR'] is set if you access via a proxy (e.g. CloudFlare).\r\n$_SERVER['HTTP_X_FORWARDED_FOR'] is also used in WCF 1.1 and really necessary to prevent fake sessions at proxies!","number":304,"url":"https://api.github.com/repos/WoltLab/WCF/issues/304","comments":6,"assignee":null},"comment":{"user":{"id":917322,"login":"Tr3kk3r","url":"https://api.github.com/users/Tr3kk3r","avatar_url":"https://secure.gravatar.com/avatar/078e321f88c6fc29e2fa02e377b1c443?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","gravatar_id":"078e321f88c6fc29e2fa02e377b1c443"},"created_at":"2011-12-17T15:02:37Z","updated_at":"2011-12-17T15:02:37Z","id":3189721,"body":"Why would you wan't to force WCF installations to use cloudflare? If someone wants to use cloudflare with his WCF, he can do so, without any further implementation of any functionality into WCF. I quote from the cloudflare website: \"There is no hardware or software to install or maintain and you do not need to change any of your site's existing code.\".\r\n\r\nif someone wants to take other measures against attacks, he can also do so.\r\n\r\nBtw: If you use fake-IP adresses to run a DDOS, than no PHP-side implementation will protect you against that. If the request reaches the webserver, the DDOS was already successful. You would probably want to change your server configuration, so that malicous packets are dropped when received and not even invoke any handling by the webserver.","url":"https://api.github.com/repos/WoltLab/WCF/issues/comments/3189721"},"action":"created"}