java - 为什么不能伪造ServletRequest.getRemoteAddr？

Question

我正在尝试查找客户端的 IP。我被告知 'request.getHeader("HTTP_X_FORWARDED_FOR")' 不可信任，因为它可能是伪造的，我应该改用 request.getRemoteAddr。(在我的情况下，只获取代理的 IP 就可以了)所以我的问题是:

为什么不能伪造ServletRequest.getRemoteAddr？

另一个问题:HTTP_X_FORWARDED_FOR 和 X_FORWARDED_FOR 有什么区别？

Answer 1

如果您执行 request.getRemoteAddr();

如果用户在代理服务器后面或通过负载平衡器访问您的网络服务器，则上述代码将获取代理服务器或负载平衡器服务器的 IP 地址，而不是客户端的原始 IP 地址。

如果

In my case it's ok to just get the proxy's IP

你没问题然后 request.getRemoteAddr();就够了。

但在理想情况下你应该试试这个

//is client behind something?
   String ipAddress = request.getHeader("X-FORWARDED-FOR");  
   if (ipAddress == null) {  
       ipAddress = request.getRemoteAddr();  
   }

X_FORWARDED_FOR

The X-Forwarded-For (XFF) HTTP header field is a de facto standard for identifying the originating IP address of a client connecting to a web server through an HTTP proxy or load balancer.

HTTP_X_FORWARDED_FOR

A header HTTP_X_FORWARDED_FOR is set by proxy servers to identify the ip-address of the host that is making the HTTP request through the proxy.

简而言之，它们都是相同的 header ，只是不同的实现方式有所不同。如需更多信息，请查看:HTTP Headers: What is the difference between X-FORWARDED-FOR, X_FORWARDED_FOR and HTTP_X_FORWARDED_FOR?