{"action":"opened","issue":{"url":"https://api.github.com/repos/ZF-Commons/zfc-rbac/issues/331","repository_url":"https://api.github.com/repos/ZF-Commons/zfc-rbac","labels_url":"https://api.github.com/repos/ZF-Commons/zfc-rbac/issues/331/labels{/name}","comments_url":"https://api.github.com/repos/ZF-Commons/zfc-rbac/issues/331/comments","events_url":"https://api.github.com/repos/ZF-Commons/zfc-rbac/issues/331/events","html_url":"https://github.com/ZF-Commons/zfc-rbac/issues/331","id":150577385,"number":331,"title":"Insecure IP guard example","user":{"login":"kelunik","id":2743004,"avatar_url":"https://avatars.githubusercontent.com/u/2743004?v=3","gravatar_id":"","url":"https://api.github.com/users/kelunik","html_url":"https://github.com/kelunik","followers_url":"https://api.github.com/users/kelunik/followers","following_url":"https://api.github.com/users/kelunik/following{/other_user}","gists_url":"https://api.github.com/users/kelunik/gists{/gist_id}","starred_url":"https://api.github.com/users/kelunik/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kelunik/subscriptions","organizations_url":"https://api.github.com/users/kelunik/orgs","repos_url":"https://api.github.com/users/kelunik/repos","events_url":"https://api.github.com/users/kelunik/events{/privacy}","received_events_url":"https://api.github.com/users/kelunik/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-04-23T17:24:58Z","updated_at":"2016-04-23T17:24:58Z","closed_at":null,"body":"https://github.com/ZF-Commons/zfc-rbac/blob/master/docs/04.%20Guards.md#creating-custom-guards shows a simple `IpGuard` example.\r\n\r\n```php\r\nif (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {\r\n    $clientIp = $_SERVER['HTTP_X_FORWARDED_FOR'];\r\n} else {\r\n    $clientIp = $_SERVER['REMOTE_ADDR'];\r\n}\r\n```\r\n\r\nThis example is insecure as it simply tasks a HTTP header as client IP if it's there. Anybody can just send this header and fake the client IP that way. It should be removed and reduced to `$clientIp = $_SERVER['REMOTE_ADDR'];`."}}