Mosso: Remote Address Environment Variable with WordPress 2.7

I read an interesting post over at FreshClicks.net about a potential issue with WordPress obtaining the remote address environment variable when hosting with Mosso.   It seems that WordPress sees the IP address of the load balancers and not the IP address of the client.   This results from Mosso’s load balancers acting as a proxy.  This could be a problem for anyone using “REMOTE_ADDR” in an auto-scaling cloud.  But there may be a larger issue brewing for development with cloud computing.

Wordpress and Mosso

I have tested this with WordPress 2.7, hosted with Mosso, but I haven’t ran into this issue.  Searching the WordPress Trac database yeilds no discussion.   However, there is an open ticket that’s up for grabs with a similar issue when dealing with proxy servers, which may be a growing issue with programming in the “cloud”.

Ticket #4602: Function for getting the clients IP address

WordPress misses a function to get the IP address of the original client. It is critical to have a function like this when using plugins for voting, users online and when posting comments whenWordPress runs on a server behind an HTTP proxy such as Varnish.

It checks if the header X-Forwarded-For is set (available from$_SERVER['HTTP_X_FORWARDED_FOR']) and uses the first address in this list. If it’s not set, it uses$_SERVER['REMOTE_ADDR'] instead.

The function also applies a filter called “remote_ip_address” before returning the address.

If you want a pluggable patch to this and are NOT using SSL use the patch from ticket #4602 mentioned above.

However, if you have SSL enabled for your domain you will need to replace the HTTP_X_CLUSTER_CLIENT_IP  with HTTP_X_FORWARDED_FOR.  This is because MOSSO uses a proxy for SLL, which builds a chain of client IP addresses in a comma delimited list.  The first IP address in this list. 

Here’s a quick function to get the client IP from a chained list:

if ($ip_address = $_SERVER["HTTP_X_FORWARDED_FOR"]) {
// IP addresses can be chained, separated with commas,
// we want the first one.
if (strpos($ip_address, ',') !== false) {
$ip_address = explode(',', $ip_address);
$ip_address = $ip_address[0];
}
}
else {
$ip_address = $_SERVER["REMOTE_ADDR"];
}

Someone should update the patch for ticket #4602 to reflect SSL support and verify this issue exists with other cloud networks.

Advertisements

Tags: , , , , , , , , ,

One Response to “Mosso: Remote Address Environment Variable with WordPress 2.7”

  1. Lary Stucker Says:

    Hey Terry, I don’t if you are using a plugin to solve your WordPress 2.7 with Mosso problem, but right out of the box it will have this IP address issue. This article was written to cover 2.6. I have just released an updated article that covers 2.7 here: http://www.freshclicks.net/2009/01/15/syndicated-content-and-rss/mosso-how-to-fix-comment-ip-addresses-in-wordpress-27/

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s


%d bloggers like this: