How to protect against spoofed http headers?

Question

PHP

I made my custom headers, threw a fictitious ip into them, on my server this fictitious ip was shown in the $_SERVER array, how can I protect myself from this?

Answer 1

read IP not from headers...
Anything can be sent.
$_SERVER['REMOTE_ADDR'] is not taken from headers.

Answer 2

If you send any custom header to the server, it is prefixed with HTTP_. For example, if you send a header REMOTE_ADDR, then in all scripts on your site, this header will be available as$_SERVER['HTTP_REMOTE_ADDR']
Это вывод ключей и значений массива $_SERVER. Как видно, переданный мной IP был записан в $_SERVER['HTTP_REMOTE_ADDR'], а настоящий IP записан, как полагается, в $_SERVER['REMOTE_ADDR']