Block Proxy Users in Apache

Question

It's my understanding that when in the apache access log there are 2 IP Addresses listed together on one line instead of 1, that it's a "user" using a proxy.

Example:

112.96.179.188 36.56.114.20 - [30/Nov/2017:12:43:05 -0500] "POST /customer/ HTTP/1.1" 302 - "https://www.example.com/customer/" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0"

All of the spam traffic on a site I'm managing is coming from these "users".

Is there a way in htaccess to block these from accessing the site?

janh janh · Accepted Answer · 2017-12-01T20:42:08

It's probably the X-Forwarded-For header that you're looking for.

While you can generally assume that every requests with that header comes from either a) somebody behind a proxy or b) somebody pretending to be a proxy, you cannot be sure that the absence of that header means somebody isn't using a proxy. Many proxies will not pass this information along. And as it's simply a normal HTTP header, you cannot trust the content when it is provided, as the client can set it to whatever value it wants to.

That said, you can use a RewriteCond to check for the existence and value of that field and deny the request:

RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-For} !^$
RewriteRule . - [F,L]

This will match all requests where that header is not empty (if it does not exist, it will be treated as if it is empty).

Block Proxy Users in Apache

1 Answers