On Tuesday, November 19, 2002, at 01:16  PM, Lucian Daniel Kafka wrote:

> At 01:08 PM 19/11/2002 +1100, you wrote:
>> That'd work fine till some scumbag figured out that putting in a 
>> header
>> with random HTTP_X_FORWARDED_FOR values allowed them to create a 
>> rather
>> large hole through the restrictions :-(
>>
>> In other words, the HTTP_X_FORWARDED_FOR is user-suplied data - it's 
>> not
>> to be trusted.
>
>
> But that's not the issue - it's like the locks on the door - really 
> there to keep the honest people away. It's easier to get around the 
> lookup limits in other ways that generating custom request headers...

Well, if you want a reasonably foolproof setup why not ask ausregistry 
to implement
an authenticated whois-style system? Then you can perform some useful 
statistical
checks on the access patterns.




Adrian