req.ip可以在Express.js中伪造吗? [英] Can req.ip be faked in Express.js?

问题描述

我正在尝试在服务器中实现一些反垃圾邮件机制.我需要知道Express.js中的远程黑客是否可以伪造req.ip.有人可以跟我确认一下吗?

I am trying to implement some anti-spamming mechanism into my server. I need to know whether req.ip can be faked by the remote hacker in Express.js. Could someone please confirm this with me?

推荐答案

是的，它可以被伪造. request.ip 从X-Forwarded-For标头的最左侧条目获取其值，该伪造的标头可以被伪造.

Yes, it can be faked. request.ip getting it's value from the left most entry of the X-Forwarded-For header, which can be faked.

快速文档: https://expressjs.com/en/api.html#req.ip

这篇关于req.ip可以在Express.js中伪造吗?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！