How to determine if localhost works

Question

I have a PHP script where I would like to determine if the user is working on a local computer that is not accessible via the Internet. I am currently checking the server address 127.0.0.1. Is this the best practice or is there a better way?

Answer 1

Localhost always translates to loopback 127.0.0.1 IP address in IPv4 or ::1 in IPv6, so checking the IP address inside your application will be safe if you mean

 if(IPAddress::In(array("127.0.0.1","::1"))) { //Show Application } 

I doubt very much that you will have a team of elite hackers after your port 80, but as a side note there was some talk about the flaws based on the IP address, as TCP packets can be changed.

But that should not bother you.

Answer 2

I'm not sure that the answers are still in place, but that may be confusing. I answer, in particular, to the part of your question that reads: "unavailable via the Internet." Here is my attempt to answer:

The web server, not PHP, listens on the socket and accepts connections. PHP can get connection information from $ _SERVER ( http://www.php.net/manual/en/reserved.variables.server.php ). Keep in mind that everything you check is related to where the connection came from - you cannot find out anything about whether your server is accessible through other IP addresses from $ _SERVER. For example, I can access a local Apache / PHP instance through any of:

• http: // localhost / ($ _SERVER ["SERVER_ADDR"] => :: 1)
• http://127.0.0.1/ ($ _SERVER ["SERVER_ADDR"] => 127.0.0.1)
• http://192.168.75.121/ ($ _SERVER ["SERVER_ADDR"] => 192.168.75.121)
• http: //shiva.local/ ($ _SERVER ["SERVER_ADDR"] => fe80 :: 21c: 42ff: fe00: 8)

So, if your plan is that the application should behave differently after seeing the "correct" value in $ _SERVER ["SERVER_ADDR"], you are probably pretty safe, that is, it is unlikely that the user can fake the user from the remote customer.

Having said all this, I would not use any of these methods to authenticate users or authorize user privileges / actions in a deployed application accessible via the Internet. The only exception may be if you have the entire application that should be accessible only when accessing from the local host - then this method probably makes good sense and will be safe enough for a personal application.

Answer 3

You can also check the localhost hostname, but if the server address is 127.0.0.1, then it must be resolved. This is standard practice on ipv4. On ipv6, you can check :: 1, as Robert Pitt suggests.