获取客户端的IP地址

Bhu*_*han 43 java ip servlets web-applications

我正在使用JSP,Servlets(Container:Glassfish)开发一个Web应用程序,我需要在其中获取客户端IP Address.

我正在获取客户端的IP地址,因为我只想在有办公室的计算机上访问某些页面(如客户维护表单),我想限制访问办公室以外的那些页面.

以下是我的代码到目前为止:

WAY1

String ipAddress =  request.getRemoteAddr();
System.out.println("IP Address: "+ipAddress);
Run Code Online (Sandbox Code Playgroud)

way2

String ipAddress=null;
String getWay = request.getHeader("VIA");   // Gateway
ipAddress = request.getHeader("X-FORWARDED-FOR");   // proxy
if(ipAddress==null)
{
    ipAddress = request.getRemoteAddr();
}
System.out.println("IP Address: "+ipAddress);
Run Code Online (Sandbox Code Playgroud)

different IP Address每次重新启动计算机时,上面的代码都会给我(关机 - >启动或重启).

我变得IP6喜欢:

fe80:0:0:0:20ca:1776:f5ff:ff15%13
Run Code Online (Sandbox Code Playgroud)

让我知道这段代码有什么问题?

Xav*_*tte 69

正如@martin和这个答案解释的那样,它很复杂.获取客户端的IP地址没有防弹方法.

你能做的最好的事情就是尝试解析"X-Forwarded-For"和依赖request.getRemoteAddr();

public static String getClientIpAddress(HttpServletRequest request) {
    String xForwardedForHeader = request.getHeader("X-Forwarded-For");
    if (xForwardedForHeader == null) {
        return request.getRemoteAddr();
    } else {
        // As of https://en.wikipedia.org/wiki/X-Forwarded-For
        // The general format of the field is: X-Forwarded-For: client, proxy1, proxy2 ...
        // we only want the client
        return new StringTokenizer(xForwardedForHeader, ",").nextToken().trim();
    }
}
Run Code Online (Sandbox Code Playgroud)

  • 很好,但是如果要实现安全性,请小心,因为所有这些标头都容易伪造. (12认同)
  • 请参阅nginx设置以防止伪造:https://devcentral.f5.com/questions/prevent-x-forwarded-for-spoofing (3认同)

bas*_*ero 32

我使用以下静态帮助器方法来检索客户端的IP:

public static String getClientIpAddr(HttpServletRequest request) {  
    String ip = request.getHeader("X-Forwarded-For");  
    if (ip == null || ip.length() == 0 || ip.equalsIgnoreCase("unknown")) {  
        ip = request.getHeader("Proxy-Client-IP");  
    }  
    if (ip == null || ip.length() == 0 || ip.equalsIgnoreCase("unknown")) {  
        ip = request.getHeader("WL-Proxy-Client-IP");  
    }  
    if (ip == null || ip.length() == 0 || ip.equalsIgnoreCase("unknown")) {  
        ip = request.getHeader("HTTP_X_FORWARDED_FOR");  
    }  
    if (ip == null || ip.length() == 0 || ip.equalsIgnoreCase("unknown")) {  
        ip = request.getHeader("HTTP_X_FORWARDED");  
    }  
    if (ip == null || ip.length() == 0 || ip.equalsIgnoreCase("unknown")) {  
        ip = request.getHeader("HTTP_X_CLUSTER_CLIENT_IP");  
    }  
    if (ip == null || ip.length() == 0 || ip.equalsIgnoreCase("unknown")) {  
        ip = request.getHeader("HTTP_CLIENT_IP");  
    }  
    if (ip == null || ip.length() == 0 || ip.equalsIgnoreCase("unknown")) {  
        ip = request.getHeader("HTTP_FORWARDED_FOR");  
    }  
    if (ip == null || ip.length() == 0 || ip.equalsIgnoreCase("unknown")) {  
        ip = request.getHeader("HTTP_FORWARDED");  
    }  
    if (ip == null || ip.length() == 0 || ip.equalsIgnoreCase("unknown")) {  
        ip = request.getHeader("HTTP_VIA");  
    }  
    if (ip == null || ip.length() == 0 || ip.equalsIgnoreCase("unknown")) {  
        ip = request.getHeader("REMOTE_ADDR");  
    }  
    if (ip == null || ip.length() == 0 || ip.equalsIgnoreCase("unknown")) {  
        ip = request.getRemoteAddr();  
    }  
    return ip;  
}
Run Code Online (Sandbox Code Playgroud)

  • 对于那些对此解决方案感兴趣的人,这里有一个更简洁、更专业的代码:https://memorynotfound.com/client-ip-address-java/ (3认同)
  • 使用通过这些标头获得的一些可能值更新问题可能是有意义的.首先:该值可以只是一个IPv4地址(`wxyz`),但它也可以是逗号分隔的IPv4地址列表(`wxyz,abcd`,在这种情况下,客户端IP始终是第一个一个),或者你可以得到一个IPv6或你得到非法的值(我观察单个整数,如'286`或只是'UNKNOWN`)... (2认同)
  • 这太糟糕了,我不知道从哪里开始.环境变量不可用作HTTP标头,并且对于测试客户端IP完全没用.如果实际上需要测试十个标题,为什么要测试它们,或者为什么不循环.此外,"未知"永远不会被设置为默认值,只有客户端明确设置它时.所以这些标题都可以由客户手动设置为"HAHAHA".唯一有效的方法实际上是request.getRemoteAddr(),这很幸运,因为它是最后一次测试.检查"X-Forwarded-For"可以完成(如果你信任代理),但应该解析! (2认同)

小智 7

我喜欢这个,你可以尝试一下

public String getIpAddr(HttpServletRequest request) {      
   String ip = request.getHeader("x-forwarded-for");      
   if(ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {      
       ip = request.getHeader("Proxy-Client-IP");      
   }      
   if(ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {      
       ip = request.getHeader("WL-Proxy-Client-IP");      
   }      
   if(ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {      
       ip = request.getRemoteAddr();      
   }      
   return ip;      
}   
Run Code Online (Sandbox Code Playgroud)

  • 所有这些错误答案都来自哪里?这不是一种正确的测试方法.看看类似答案的评论..! (2认同)