how to check whether perl cgi request originates from localhost

Question

I would like to expose a service written in Perl to localhost HTTP requests. I do not want to modify Apache configuration. How to check whether a Perl CGI HTTP request originates from localhost?

I want for this check to succeed even if this call is made through a virtual host eg. https://www.myserivce.com/hidden/service.pl given that the call is made from inside of www.myserivce.com.

You haven't explained what problems you ran into when trying to accomplish this. In particular, I don't understand what it is at the moment that's stopping your Perl script from doing this. — Lightness Races in Orbit
– Lightness Races in Orbit, Commented Oct 11, 2011 at 12:31
The problem is that remote_addr() sometimes returns "127.0.0.1" and sometimes some other addresses. — agsamek
– agsamek, Commented Oct 11, 2011 at 12:52
Let's see some examples of these results, and the code that obtains them. — Lightness Races in Orbit
– Lightness Races in Orbit, Commented Oct 11, 2011 at 12:53

Community · Accepted Answer · 2021-10-07 05:51:50Z

10

REMOTE_ADDR, but that's a dumb way to do it because you put the authentication logic in the application.

Instead, bind a stand-alone Web server to local interface only, thus the operating system's IP/networking stack guarantees that no request from outside can reach the server.

edited Oct 7, 2021 at 5:51

CommunityBot

11 silver badge

answered Sep 28, 2011 at 11:16

daxim

39.3k4 gold badges71 silver badges135 bronze badges

Sign up to request clarification or add additional context in comments.

8 Comments

agsamek Over a year ago

And what should I check with REMOTE_ADDR ? It returns 127.0.0.1 but sometimes it returns IP of the interface (I do not have control over machine to start a web server)

daxim Over a year ago

Check it against localhost IP addresses (in 127.0.0.0/8 and ::1/128, let Net::CIDR::Lite assist you) or the address of the interface. If the test fails, reject the request.

agsamek Over a year ago

Doesn't work - I get public 194.xx.xx.xx address, even though the request comes from localhost.

daxim Over a year ago

Yes, I have understood that; also, when you use a hostname which resolves to the IP address of the public interface, that's not really localhost - this word has a specific meaning. Anyway, the word or in my previous comment is indeed the Boolean logical or. Apply this information.

Lightness Races in Orbit Over a year ago

@agsamek: Your demand for code is offensive. Demonstrate a willingness to learn and to gain understanding, please.

|

Tudor Constantin · Accepted Answer · 2011-10-09 08:05:43Z

1

+50

I think that if you put in /etc/hosts file an entry with myservice.com and ip 127.0.0.1 then all the requests from localhost to your site will have the REMOTE_ADDR set to 127.0.0.1 .

I am afraid that this is the only way to do it, unless you are making requests to 127.0.0.1/hidden/service.pl instead of myservice.com/hidden/service.pl

answered Oct 9, 2011 at 8:05

Tudor Constantin

26.9k7 gold badges54 silver badges73 bronze badges

Comments

agsamek · Accepted Answer · 2011-10-11 12:27:43Z

0

I have used the following code:

my $server_addr = inet_ntoa(scalar gethostbyname(hostname() || 'localhost'));
my $call_addr = $query->remote_addr();
die unless $call_addr eq "127.0.0.1" || $call_addr eq $server_addr;

I do not think it covers all cases, but seems to work with my setup. If anybody knows a generic solution then please submit it here.

answered Oct 11, 2011 at 12:27

agsamek

9,14411 gold badges40 silver badges43 bronze badges

Collectives™ on Stack Overflow

how to check whether perl cgi request originates from localhost

3 Answers 3

8 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

8 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related