JSP to get real IP address

In JSP, the method to obtain the client's IP address is: request.getRemoteAddr(), which is effective in most cases. However, after passing through Apache, Squid and other reverse proxy software, the real IP address of the client cannot be obtained. If a reverse proxy software is used, the IP address obtained by the request.getRemoteAddr() method is: 127.0.0.1 or 192.168.1.110, not the real IP of the client.

    After passing through the proxy, because an intermediate layer is added between the client and the service, the server cannot directly obtain the client's IP, and the server-side application cannot directly return the address to the client through the forwarding request. However, X-FORWARDED-FOR information is added to the HTTP header information of the forwarding request. Used to track the original client IP address and the server address requested by the original client. When we access index.jsp/, it is not that our browser actually accesses the index.jsp file on the server, but the proxy server first accesses index.jsp, and the proxy server returns the accessed result to our Browser, because it is the proxy server to access index.jsp, the IP obtained by the method of request.getRemoteAddr() in index.jsp is actually the address of the proxy server, not the IP address of the client.



Method 1 to get the real IP address of the client:

[java] view plaincopy
public String getRemortIP(HttpServletRequest request) {  
    if (request.getHeader("x-forwarded-for") == null) {  
        return request.getRemoteAddr();  
    }  
    return request.getHeader("x-forwarded-for");  
}    
获得客户端真实IP地址的方法二:

[java] view plaincopy
public String getIpAddr(HttpServletRequest request) {  
    String ip = request.getHeader("x-forwarded-for");  
    if(ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {  
        ip = request.getHeader("Proxy-Client-IP");  
    }  
    if(ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {  
        ip = request.getHeader("WL-Proxy-Client-IP");  
    }  
    if(ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {  
        ip = request.getRemoteAddr();  
    }  
    return ip;  
} 

    However, if the multi-level reverse proxy is passed, the value of X-Forwarded-For is not more than one, but a series of IP values. Which is the real IP of the real client?

    The answer is to take the first non-unknown valid IP string in X-Forwarded-For. For example:

    X-Forwarded-For: 192.168.1.110, 192.168.1.120, 192.168.1.130, 192.168.1.100 The

    real IP of the user is: 192.168.1.110