Django获取请求IP的正确方法和最佳实践

# ❌ 错误：'IP' 不是Django的标准META key
ip = request.META['IP']  # KeyError!

# ❌ 错误：只用REMOTE_ADDR，代理时会出错
ip = request.META['REMOTE_ADDR']  # 代理时返回127.0.0.1

HTTP_X_FORWARDED_FOR > HTTP_X_REAL_IP > REMOTE_ADDR

def get_client_ip(request):
    """
    获取客户端真实IP（支持直连、代理、CDN）
    
    Args:
        request: Django的HttpRequest对象
    
    Returns:
        str: 客户端真实IP
    """
    # 1. 优先从 HTTP_X_FORWARDED_FOR 获取（代理传递的真实IP）
    x_forwarded_for = request.META.get('HTTP_X_FORWARDED_FOR')
    if x_forwarded_for:
        # 可能有多个IP（如：client, proxy1, proxy2），取第一个
        ip = x_forwarded_for.split(',')[0].strip()
    else:
        # 2. 没有代理，直接用 REMOTE_ADDR
        ip = request.META.get('REMOTE_ADDR', '127.0.0.1')
    
    # 3. 过滤内网IP（可选，防止伪造）
    if ip.startswith('127.') or ip.startswith('192.168.'):
        return '0.0.0.0'
    
    return ip

def my_view(request):
    ip = get_client_ip(request)
    print(f"客户端IP: {ip}")  # 输出：123.45.67.89
    return JsonResponse({'ip': ip})

def get_client_ip(request):
    """
    获取客户端真实IP（防伪造、支持多层代理）
    """
    # 尝试多个可能的IP来源（按优先级排序）
    ip_keys = [
        'HTTP_X_FORWARDED_FOR',
        'HTTP_X_REAL_IP',
        'HTTP_CLIENT_IP',
        'REMOTE_ADDR',
    ]
    
    for key in ip_keys:
        ip = request.META.get(key)
        if ip:
            # HTTP_X_FORWARDED_FOR 可能有多个IP，取第一个
            if key == 'HTTP_X_FORWARDED_FOR':
                ip = ip.split(',')[0].strip()
            
            # 过滤内网IP和无效IP
            if ip and not ip.startswith(('127.', '192.168.', '0.')):
                return ip
    
    return '0.0.0.0'

# middleware.py
class ClientIPMiddleware:
    """
    中间件：自动在request对象上添加client_ip属性
    """
    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        # 获取真实IP
        x_forwarded_for = request.META.get('HTTP_X_FORWARDED_FOR')
        if x_forwarded_for:
            request.client_ip = x_forwarded_for.split(',')[0].strip()
        else:
            request.client_ip = request.META.get('REMOTE_ADDR', '127.0.0.1')
        
        response = self.get_response(request)
        return response

MIDDLEWARE = [
    # ... 其他中间件
    'myapp.middleware.ClientIPMiddleware',  # ⭐ 添加这行
]

def my_view(request):
    ip = request.client_ip  # ⭐ 直接用，超方便！
    print(f"客户端IP: {ip}")
    return JsonResponse({'ip': ip})

server {
    listen 80;
    server_name example.com;
    location / {
        proxy_pass http://127.0.0.1:8000;
        # ⭐⭐⭐ 关键：传递真实IP ⭐⭐⭐
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# ✅ 现在REMOTE_ADDR就是真实IP了
ip = request.META.get('REMOTE_ADDR')

# 恶意请求（伪造IP）
curl -H "X-Forwarded-For: 8.8.8.8" http://your-server.com

# 取第一个（最左边的是真实IP）
ip = request.META.get('HTTP_X_FORWARDED_FOR').split(',')[0].strip()

# IPv6地址示例：2001:0db8:85a3::8a2e:0370:7334
# 同样适用上述方法
ip = get_client_ip(request)  # 支持IPv4和IPv6

# utils.py
class IPUtils:
    @staticmethod
    def get_client_ip(request):
        """获取客户端真实IP（防伪造、支持代理）"""
        for key in ['HTTP_X_FORWARDED_FOR', 'HTTP_X_REAL_IP', 'HTTP_CLIENT_IP', 'REMOTE_ADDR']:
            ip = request.META.get(key)
            if ip:
                if key == 'HTTP_X_FORWARDED_FOR':
                    ip = ip.split(',')[0].strip()
                if ip and not ip.startswith(('127.', '192.168.', '0.')):
                    return ip
        return '0.0.0.0'

# 使用
from myapp.utils import IPUtils
ip = IPUtils.get_client_ip(request)

# ✅ 最简单：复制这个函数就够了
def get_client_ip(request):
    x_forwarded_for = request.META.get('HTTP_X_FORWARDED_FOR')
    if x_forwarded_for:
        return x_forwarded_for.split(',')[0].strip()
    return request.META.get('REMOTE_ADDR', '127.0.0.1')

# 使用
ip = get_client_ip(request)