No, it's not. I can provide valid IP but different from real one. For example, if I'd use such check for Gii and limiting its use to 127.0.0.1 the check would be very easy to pass with just sending "forwarded for" header containing 127.0.0.1