How can I change IP in HttpServletRequest from server side?

Question

A lot of people ask how to change de IP from the client side, but I need to do it (if it's possible) from the server side.

The thing is that I get the IP from the HttpServletRequest.getRemoteAddr(), but now that we use a Proxy before our IHS, this IP always comes with the Proxy IP, not the real client IP.

The proxy provides the real IP in a new specific Header in the request.

Ok, I know that it sounds easy, I only change the way I get the IP and get it from the specific Header that the Proxy provides. It is a good solution, the problem is that we have to change a lot of classes and I'm thinking in another possible way, for example, changing this IP once with the real one in the Request in a BaseClass and then everybody (who extends the BaseClass) gets the IP correctly updated.

So, can I do this somehow?

Answer 1

You need to add a Filter that create HttpServletRequestWrapper. Adapt the deployment descriptor.

The Parts:

• ProxyFilter
• ProxyRequestWrapper
• web.xml
• ServletBehindProxy

The ProxyFilter:

package testingThings.wrapperAndFilter;

import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

/**
 * Servlet Filter implementation class ProxyFilter
 */
public class ProxyFilter implements Filter {

    /**
     * Default constructor. 
     */
    public ProxyFilter() {
        // TODO Auto-generated constructor stub
    }

    /**
     * @see Filter#destroy()
     */
    public void destroy() {
        // TODO Auto-generated method stub
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        // delegate to the Http related doFilter method
        doFilter((HttpServletRequest)request, (HttpServletResponse)response, chain);        
    }

    public void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
        // create a wrapper
        ProxyRequestWrapper replacementRequest = new ProxyRequestWrapper(request);

        // pass the request along the filter chain
        chain.doFilter(replacementRequest, response);
    }

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        // TODO Auto-generated method stub

    }
}

The ProxyRequestWrapper:

package testingThings.wrapperAndFilter;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

public class ProxyRequestWrapper extends HttpServletRequestWrapper {

    public ProxyRequestWrapper(HttpServletRequest request) {
        super(request);
    }

    @Override
    public String getRemoteAddr() {
        return getHeader("REAL-IP");
    }
}

web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0">
  <filter>
    <filter-name>ProxyFilter</filter-name>
    <filter-class>testingThings.wrapperAndFilter.ProxyFilter</filter-class>
  </filter>
  <filter-mapping>
    <filter-name>ProxyFilter</filter-name>
    <url-pattern>/ServletBehindProxy</url-pattern>
  </filter-mapping>
</web-app>

ServletBehindProxy:

package testingThings.wrapperAndFilter;

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

/**
 * Servlet implementation class ServletBehindProxy
 */
@WebServlet("/ServletBehindProxy")
public class ServletBehindProxy extends HttpServlet {
    private static final long serialVersionUID = 1L;

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        // show ip
        resp.getWriter().append(req.getRemoteAddr());
    }

}

To test it, you could use the ModifyHeaders Browser-Plugin: