Automattic\WooCommerce\Admin\API

MobileAppQRLogin::get_client_ip │ private │ WC 1.0

Get the client IP address used as the per-IP rate-limit key.

Uses REMOTE_ADDR exclusively. We intentionally do not honor HTTP_X_FORWARDED_FOR here: the exchange endpoint is unauthenticated, and without a project-wide trusted-proxy list we cannot tell a legitimate proxy header from an attacker-supplied one. Trusting the first XFF value would let any client choose a fresh rate-limit bucket per request and bypass per-IP caps. On sites behind a CDN/load balancer that all clients share, REMOTE_ADDR is the proxy IP, so exchange uses broad IP throttling only as an abuse guard and relies on token-scoped buckets for security.

Method of the class: MobileAppQRLogin{}

No Hooks.

Returns

String.

Usage

// private - for code of main (parent) class only
$result = $this->get_client_ip();

MobileAppQRLogin::get_client_ip() code WC 11.0.1

woocommerce/src/Admin/API/MobileAppQRLogin.php 
private function get_client_ip() {
	if ( ! empty( $_SERVER['REMOTE_ADDR'] ) ) {
		return sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) );
	}
	return '';
}