How to extract IP Address in Spring MVC Controller get call?

Question

I am working on Spring MVC controller project in which I am making a GET URL call from the browser -

Below is the url by which I am making a GET call from the browser -

http://127.0.0.1:8080/testweb/processing?workflow=test&conf=20140324&dc=all

And below is the code in which the call comes after hitting at the browser -

@RequestMapping(value = "processing", method = RequestMethod.GET)
public @ResponseBody ProcessResponse processData(@RequestParam("workflow") final String workflow,
    @RequestParam("conf") final String value, @RequestParam("dc") final String dc) {

        System.out.println(workflow);
        System.out.println(value);
        System.out.println(dc);

        // some other code
    }

Problem Statement:-

Now is there any way, I can extract IP Address from some header? Meaning I would like to know from which IP Address, call is coming, meaning whoever is calling above URL, I need to know their IP Address. Is this possible to do?

Try using Spring AOP and handling HttpServletRequest. stackoverflow.com/questions/19271807/… — Dilip G
– Dilip G, Commented Nov 21, 2019 at 17:54

Koitoer · Accepted Answer · 2014-04-05 06:33:19Z

198

The solution is

@RequestMapping(value = "processing", method = RequestMethod.GET)
public @ResponseBody ProcessResponse processData(@RequestParam("workflow") final String workflow,
    @RequestParam("conf") final String value, @RequestParam("dc") final String dc, HttpServletRequest request) {

        System.out.println(workflow);
        System.out.println(value);
        System.out.println(dc);
        System.out.println(request.getRemoteAddr());
        // some other code
    }

Add HttpServletRequest request to your method definition and then use the Servlet API

Spring Documentation here said in

15.3.2.3 Supported handler method arguments and return types

Handler methods that are annotated with @RequestMapping can have very flexible signatures.
Most of them can be used in arbitrary order (see below for more details).

Request or response objects (Servlet API). Choose any specific request or response type,
for example ServletRequest or HttpServletRequest

answered Apr 5, 2014 at 6:33

Koitoer

19.6k7 gold badges68 silver badges87 bronze badges

Sign up to request clarification or add additional context in comments.

9 Comments

john Over a year ago

Thanks Koitoer for the help. One quick question, suppose if the call is coming from Load Balancer instead of specific machine then this will work as well? I guess not..

Koitoer Over a year ago

Check probably load balancer can send those values in a header, so consider using getHeader method of HttpServletRequest.

Dipesh Gandhi Over a year ago

I am getting wrong ip address (0:0:0:0:0:0:0:1) if the request from postman. Do anyone have idea, how to get ip address even if the request from the postman?

code Over a year ago

I'm also getting 0:0:0:0:0:0:0:1

Gewure Over a year ago

This is deprecated.

|

starball · Accepted Answer · 2022-12-24 00:38:09Z

149

I am late here, but this might help someone looking for the answer. Typically servletRequest.getRemoteAddr() works.

In many cases your application users might be accessing your web server via a proxy server or maybe your application is behind a load balancer.

So you should access the X-Forwarded-For http header in such a case to get the user's IP address.

e.g. String ipAddress = request.getHeader("X-FORWARDED-FOR");

edited Dec 24, 2022 at 0:38

starball♦

59.6k53 gold badges315 silver badges1k bronze badges

answered Apr 15, 2015 at 3:55

sunitkatkar

2,1261 gold badge15 silver badges12 bronze badges

5 Comments

Raman Over a year ago

Note that X-Forwarded-For is generally a comma-separated list of ips, with each proxy in the chain adding the remote address it sees to the list. So a good implementation would generally have a list of trusted proxies and "skip" those ips when reading this header from right to left.

Muneeb Mirza Over a year ago

how to get ip address as 111.111.111.111/X

Gediminas Rimsa Over a year ago

Note that e.g. Tomcat has RemoteIpValve that parses X-Forwarded-For header and sets it on the HttpServletRequest, so that servletRequest.getRemoteAddr() returns correct end-user IP address. In Spring Boot it can be enabled via server.tomcat.remote-ip-header=X-Forwarded-For application property

Klesun Over a year ago

Can't X-FORWARDED-FOR header be spoofed by the client? Wouldn't it be safer to only assume X-FORWARDED-FOR valid if getRemoteAddr() belongs to a whitelist of credible proxy service providers?

icguy Over a year ago

Spring boot is able to automatically resolve the forwarded IP address for you. See this question for details.

Neloop · Accepted Answer · 2019-11-13 17:17:55Z

62

I use such method to do this

public class HttpReqRespUtils {

    private static final String[] IP_HEADER_CANDIDATES = {
        "X-Forwarded-For",
        "Proxy-Client-IP",
        "WL-Proxy-Client-IP",
        "HTTP_X_FORWARDED_FOR",
        "HTTP_X_FORWARDED",
        "HTTP_X_CLUSTER_CLIENT_IP",
        "HTTP_CLIENT_IP",
        "HTTP_FORWARDED_FOR",
        "HTTP_FORWARDED",
        "HTTP_VIA",
        "REMOTE_ADDR"
    };

    public static String getClientIpAddressIfServletRequestExist() {

        if (RequestContextHolder.getRequestAttributes() == null) {
            return "0.0.0.0";
        }

        HttpServletRequest request = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getRequest();
        for (String header: IP_HEADER_CANDIDATES) {
            String ipList = request.getHeader(header);
            if (ipList != null && ipList.length() != 0 && !"unknown".equalsIgnoreCase(ipList)) {
                String ip = ipList.split(",")[0];
                return ip;
            }
        }

        return request.getRemoteAddr();
    }
}

edited Nov 13, 2019 at 17:17

Neloop

1578 bronze badges

answered Mar 20, 2019 at 17:30

panser

2,14923 silver badges17 bronze badges

4 Comments

Maifee Ul Asad Over a year ago

where do i use it ?

Manuel Larrota Over a year ago

It is a static class, it uses the name of the class and the method ip = HttpReqRespUtils.getClientIpAddressIfServletRequestExist();

Jason Law Over a year ago

For those who are wondering why return 0.0.0.0 when RequestContextHolder.getRequestAttributes() == null, see 0.0.0.0 - Wikipedia.

Muhammad Tariq Over a year ago

Add if (ip.equals("0:0:0:0:0:0:0:1")) ip = "127.0.0.1"; before return ip statement in the above code to make it IPv4 complaint.

Radouane ROUFID · Accepted Answer · 2017-05-21 15:14:34Z

19

You can get the IP address statically from the RequestContextHolder as below :

HttpServletRequest request = ((ServletRequestAttributes) RequestContextHolder.currentRequestAttributes())
        .getRequest();

String ip = request.getRemoteAddr();

edited May 21, 2017 at 15:14

answered May 21, 2017 at 15:09

Radouane ROUFID

10.9k9 gold badges47 silver badges82 bronze badges

Comments

BaDr Amer · Accepted Answer · 2020-04-29 05:58:17Z

9

In my case, I was using Nginx in front of my application with the following configuration:

location / {
     proxy_pass        http://localhost:8080/;
     proxy_set_header  X-Real-IP $remote_addr;
     proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header  Host $http_host;
     add_header Content-Security-Policy 'upgrade-insecure-requests';
}

so in my application I get the real user ip like so:

String clientIP = request.getHeader("X-Real-IP");

answered Apr 29, 2020 at 5:58

BaDr Amer

94012 silver badges30 bronze badges

1 Comment

Andrew G Over a year ago

Thank you sir. It's a graceful solution that helped me.

Vagner Nogueira · Accepted Answer · 2019-11-03 17:07:29Z

See below. This code works with spring-boot and spring-boot + apache CXF/SOAP.

    // in your class RequestUtil
    private static final String[] IP_HEADER_NAMES = { 
                                                        "X-Forwarded-For",
                                                        "Proxy-Client-IP",
                                                        "WL-Proxy-Client-IP",
                                                        "HTTP_X_FORWARDED_FOR",
                                                        "HTTP_X_FORWARDED",
                                                        "HTTP_X_CLUSTER_CLIENT_IP",
                                                        "HTTP_CLIENT_IP",
                                                        "HTTP_FORWARDED_FOR",
                                                        "HTTP_FORWARDED",
                                                        "HTTP_VIA",
                                                        "REMOTE_ADDR"
                                                    };

    public static String getRemoteIP(RequestAttributes requestAttributes)
    {
        if (requestAttributes == null)
        {
            return "0.0.0.0";
        }
        HttpServletRequest request = ((ServletRequestAttributes) requestAttributes).getRequest();
        String ip = Arrays.asList(IP_HEADER_NAMES)
            .stream()
            .map(request::getHeader)
            .filter(h -> h != null && h.length() != 0 && !"unknown".equalsIgnoreCase(h))
            .map(h -> h.split(",")[0])
            .reduce("", (h1, h2) -> h1 + ":" + h2);
        return ip + request.getRemoteAddr();
    }

    //... in service class:
    String remoteAddress = RequestUtil.getRemoteIP(RequestContextHolder.currentRequestAttributes());

:)

Leon · Accepted Answer · 2019-03-06 14:15:08Z

6

Below is the Spring way, with autowired request bean in @Controller class:

@Autowired 
private HttpServletRequest request;

System.out.println(request.getRemoteHost());

answered Mar 6, 2019 at 14:15

Leon

3,25238 silver badges40 bronze badges

1 Comment

Andy Over a year ago

This could cause issues with concurrent use of the controller across multiple threads. Only singletons should be injected into @Controller instances using @Autowired. Otherwise, you must use @Scope(BeanDefinition.SCOPE_PROTOTYPE) on the controller class to ensure that a new instance of the controller is made with every request. This is less efficient, but is a workaround if you must inject something as a property to the controller class.

BaiJiFeiLong · Accepted Answer · 2019-08-10 12:38:52Z

6

Put this method in your BaseController:

@SuppressWarnings("ConstantConditions")
protected String fetchClientIpAddr() {
    HttpServletRequest request = ((ServletRequestAttributes) (RequestContextHolder.getRequestAttributes())).getRequest();
    String ip = Optional.ofNullable(request.getHeader("X-FORWARDED-FOR")).orElse(request.getRemoteAddr());
    if (ip.equals("0:0:0:0:0:0:0:1")) ip = "127.0.0.1";
    Assert.isTrue(ip.chars().filter($ -> $ == '.').count() == 3, "Illegal IP: " + ip);
    return ip;
}

answered Aug 10, 2019 at 12:38

BaiJiFeiLong

4,7951 gold badge37 silver badges37 bronze badges

Comments

Kyo Huu · Accepted Answer · 2020-06-25 16:33:46Z

private static final String[] IP_HEADER_CANDIDATES = {
            "X-Forwarded-For",
            "Proxy-Client-IP",
            "WL-Proxy-Client-IP",
            "HTTP_X_FORWARDED_FOR",
            "HTTP_X_FORWARDED",
            "HTTP_X_CLUSTER_CLIENT_IP",
            "HTTP_CLIENT_IP",
            "HTTP_FORWARDED_FOR",
            "HTTP_FORWARDED",
            "HTTP_VIA",
            "REMOTE_ADDR"
    };

    public static String getIPFromRequest(HttpServletRequest request) {
        String ip = null;
        if (request == null) {
            if (RequestContextHolder.getRequestAttributes() == null) {
                return null;
            }
            request = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getRequest();
        }

        try {
            ip = InetAddress.getLocalHost().getHostAddress();
        } catch (Exception e) {
            e.printStackTrace();
        }
        if (!StringUtils.isEmpty(ip))
            return ip;

        for (String header : IP_HEADER_CANDIDATES) {
            String ipList = request.getHeader(header);
            if (ipList != null && ipList.length() != 0 && !"unknown".equalsIgnoreCase(ipList)) {
                return ipList.split(",")[0];
            }
        }

        return request.getRemoteAddr();
    }

I combie the code above to this code work for most case. Pass the HttpServletRequest request you get from the api to the method

Harsh · Accepted Answer · 2022-11-28 06:15:14Z

2

In my case request.getRemoteAddr() contains the IP address of system from which user is trying to access the application. and in case, if I am running my application on localhost or 127.0.0.1 it is returning "0:0:0:0:0:0:0:1"

answered Nov 28, 2022 at 6:15

Harsh

531 silver badge6 bronze badges

Comments

Ulug'bek · Accepted Answer · 2022-01-12 06:58:01Z

1

In my case, I am using this piece of code:

private String getRemoteAddr(HttpServletRequest req) {
    if (!StringUtils.isEmpty(req.getHeader("X-Real-IP"))) {
        return req.getHeader("X-Real-IP");
    }
    return req.getRemoteAddr();
}

answered Jan 12, 2022 at 6:58

Ulug'bek

2,8426 gold badges35 silver badges62 bronze badges

Collectives™ on Stack Overflow

How to extract IP Address in Spring MVC Controller get call?

11 Answers 11

9 Comments

5 Comments

4 Comments

Comments

1 Comment

Comments

1 Comment

Comments

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

11 Answers 11

9 Comments

5 Comments

4 Comments

Comments

1 Comment

Comments

1 Comment

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related