ADL-004
Check the AdsLab sender IP, and what Cloudflare does to it
Their postbacks come from one address. Enforcing it is free — unless you are behind Cloudflare, where REMOTE_ADDR is Cloudflare and the check rejects everything.
A signature proves the payload was signed with your secret. Pinning the sender address adds a second, independent condition: the request also has to come from them. Cheap, and it blocks anyone replaying a captured postback from elsewhere.
AdsLab sends from 46.4.30.230. The trap is that behind Cloudflare, REMOTE_ADDR is a Cloudflare edge address, so a correct-looking check rejects every genuine postback and your site quietly stops crediting.
Read the real client address the same way everywhere else on the site, and let the operator turn the check off for the case where their host mangles it beyond recovery.
const ADSLAB_SENDER_IPS = ['46.4.30.230'];
function adslab_sender_ok(): bool
{
if (!setting_bool('adslab_check_sender_ip', true)) {
return true;
}
$ip = $_SERVER['REMOTE_ADDR'] ?? '';
// Behind Cloudflare, REMOTE_ADDR is Cloudflare. CF-Connecting-IP is set at
// the edge and cannot be spoofed past it.
if (!empty($_SERVER['HTTP_CF_CONNECTING_IP'])
&& filter_var($_SERVER['HTTP_CF_CONNECTING_IP'], FILTER_VALIDATE_IP)) {
$ip = $_SERVER['HTTP_CF_CONNECTING_IP'];
}
return in_array($ip, ADSLAB_SENDER_IPS, true);
}
// In the endpoint, before anything else:
// if (!adslab_sender_ok()) { echo 'ok'; exit; } // 200, logged, credits nothingUsing it
Log rejected senders with the address seen. If the list changes on their side, that log is how you find out rather than noticing missing revenue a week later.
Keep the toggle. A host that rewrites addresses in some other way should be able to run on signature verification alone.
Answer 200 on rejection as well. A 403 just queues retries.
What bites people
Only trust a forwarded-for style header when you know a proxy you control sets it. On a plain host, HTTP_CF_CONNECTING_IP arriving at all means someone is sending it by hand.
Their address can change without notice. Signature verification is the control that must never be optional; this one is defence in depth.
This one touches real money. Point it at a throwaway wallet and watch a full cycle before you trust it with a live balance.