使用HTTP_X_FORWARDED_FOR获取客户端IP的严重后果

//优先取得代理IP
string IP = Request.ServerVariables["HTTP_X_FORWARDED_FOR"];
if (string.IsNullOrEmpty(IP)) {
//没有代理IP则直接取连接客户端IP
IP = Request.ServerVariables["REMOTE_ADDR"];
}

HttpWebRequest request = (HttpWebRequest)HttpWebRequest.Create("http://localhost/ip.aspx");
request.Headers.Add("X_FORWARDED_FOR", "0.0.0.0");
HttpWebResponse response = (HttpWebResponse)request.GetResponse();
StreamReader stream = new StreamReader(response.GetResponseStream());
string IP = stream.ReadToEnd();
stream.Close();
response.Close();
request = null;

Response.Clear();
//优先取得代理IP
string IP = Request.ServerVariables["HTTP_X_FORWARDED_FOR"];
if (string.IsNullOrEmpty(IP))
{
//没有代理IP则直接取客户端IP
IP = Request.ServerVariables["REMOTE_ADDR"];
}
Response.Write(IP);
Response.End();