How to tell if a Request is coming from a Proxy?

Question

Is it possible to detect if an incoming request is being made through a proxy server? If a web application "bans" users via IP address, they could bypass this by using a proxy server. That is just one reason to block these requests. How can this be achieved?

Answer 1

You can look for these headers in the Request Object and accordingly decide whether request is via a proxy/not

1) Via 2) X-Forwarded-For

note that this is not a 100% sure shot trick, depends upon whether these proxy servers choose to add above headers.

Answer 2

IMHO there's no 100% reliable way to achieve this but the presence of any of the following headers is a strong indication that the request was routed from a proxy server:

via:
forwarded:
x-forwarded-for:
client-ip: 

You could also look for the proxy or pxy in the client domain name.

Answer 3

Did a bit of digging on this after my domain got hosted up on Google's AppSpot.com with nice hardcore porn ads injected into it (thanks Google).

Taking a leaf from this htaccess idea I'm doing the following, which seems to be working. I added a specific rule for AppSpot which injects a HTTP_X_APPENGINE_COUNTRY ServerVariable.

    Dim varys As New List(Of String)
    varys.Add("VIA")
    varys.Add("FORWARDED")
    varys.Add("USERAGENT_VIA")
    varys.Add("X_FORWARDED_FOR")
    varys.Add("PROXY_CONNECTION")
    varys.Add("XPROXY_CONNECTION")
    varys.Add("HTTP_PC_REMOTE_ADDR")
    varys.Add("HTTP_CLIENT_IP")
    varys.Add("HTTP_X_APPENGINE_COUNTRY")
    For Each vary As String In varys
        If Not String.IsNullOrEmpty(HttpContext.Current.Request.Headers(vary)) Then HttpContext.Current.Response.Redirect("http://www.your-real-domain.com")
    Next

Answer 4

If a proxy server is setup properly to avoid the detection of proxy servers, you won't be able to tell.

Most proxy servers supply headers as others mention, but those are not present on proxies meant to completely hide the user.

You will need to employ several detection methods, such as cookies, proxy header detection, and perhaps IP heuristics to detect such situations. Check out http://www.osix.net/modules/article/?id=765 for some information on this situation. Also consider using a proxy blacklist - they are published by many organizations.

However, nothing is 100% certain. You can employ the above tactics to avoid most simple situations, but at the end of the day it's merely a series of packets forming a TCP/IP transaction, and the TCP/IP protocol was not developed with today's ideas on security, authentication, etc.

Keep in mind that many corporations deploy company wide proxies for various reasons, and if you simply block proxies as a general rule you necessarily limit your audience, and that may not always be desirable. However, these proxies usually announce themselves with the appropriate headers - you may end up blocking legitimate users, rather than users who are good at hiding themselves.

-Adam