JSP how to get client real IP address _jsp programming

In JSP, the method for obtaining client IP is: request.getremoteaddr (). This method is effective in most cases, but can not obtain the real IP address of the client when the reverse proxy software such as Apache,squid is passed.

If the reverse proxy software is used, the http://192.168.1.110:3306/URL is reversed to the http://www.8888.com/URL, with REQUEST.GETREMOTEADDR () Method gets the IP address: 127.0.0.1 or 192.168.1.110, not the real IP of the client.

After the agent, because the client and the service increased between the middle tier, so the server can not directly to the client IP, server-side applications can not directly by forwarding the requested address to return to the client. However, in the HTTP header message that forwards the request, the X-forwarded-for information is added. The server address used to track the original client IP address and the original client request. When we visit http://www.8888.com/index.jsp/, actually not our browser actually accesses the index.jsp file on the server, but first by the proxy server to access the http://192.168.1.110:3306/ INDEX.JSP, the proxy server will return the results of the access to our browser, because it is the proxy server to access index.jsp, so index.jsp through REQUEST.GETREMOTEADDR () method to obtain the IP is actually the proxy server address, not the client's IP address.

Then you can get the client real IP address method one:

Public String Getremortip (httpservletrequest request)
{
  if (Request.getheader ("x-forwarded-for") = = null)
  {return
    request.getremoteaddr ();
  }
  Return Request.getheader ("X-forwarded-for");

But when I visit http://www.xxx.com/index.jsp/, the IP address that is returned is always unknown, not 127.0.0.1 or 192.168.1.110 as shown above, and I visit http:// 192.168.1.110:3306/index.jsp, you can return the client's real IP address, write a method to verify. The reason is on squid. The squid.conf configuration file forwarded_for The default is on, if Forwarded_for is set to OFF: X-forwarded-for:unknown

Then you can get the client real IP address of the method two:

public string getipaddr (HttpServletRequest request)
{
  String IP = request.getheader ("x-forwarded-for");
  if (IP = null | | ip.length () = = 0 | | "Unknown". Equalsignorecase (IP)
  {
    IP = request.getheader ("Proxy-client-ip");
  }
  if (IP = null | | ip.length () = = 0 | | "Unknown". Equalsignorecase (IP)
  {
    IP = request.getheader ("Wl-proxy-client-ip");
  }
  if (IP = null | | ip.length () = = 0 | | "Unknown". Equalsignorecase (IP)
  {
    IP = request.getremoteaddr ();
  }
  return IP;
}

However, if the adoption of multi-level reverse proxy, x-forwarded-for value and more than one, but a series of IP values, exactly which is the real user end of the real IP?

The answer is: Take the first unknown valid IP string in x-forwarded-for.

such as: x-forwarded-for:192.168.1.110, 192.168.1.120, 192.168.1.130, 192.168.1.100

User Real IP is: 192.168.1.110

Both of the above methods are feasible, do not use the REQUEST.GETREMOTEADDR () method alone to obtain the client IP, this method is not ideal.

Hope this article is helpful to everyone's study.