Resteasy security interceptor - how to obtain client IP address inside interceptor?

Question

I have implemented an interceptor to carry out a security check on the client IP address with the following annotations - @Provider @ServerInterceptor @Precedence("SECURITY")

The preprocess method takes the parameters HttpRequest request, ResourceMethod method. Is there a way of obtaining the client's IP address from the Resteasy HttpRequest object? I can implement a filter to get around this, but would like to keep security checks in the one place.

Answer 1

The client IP address is available from the request object. But you can't use that for security purposes as it isn't unique per client: it might just be the address of the nearest proxy, even your own.

Answer 2

This (my) answer is wrong! The HttpServletRequest is "injected" only when the filter class is instantiated, so the instance "see" the same HttpServletRequest for all the subsequent requests (the HttpServletREquest is always the first!!!!!)

---

You can inject the HttpServletRequest object to access the client ip (I'm using it)

@Provider
@Interceptor
@Precedence("SECURITY")
public class JAXRSInterceptor implements PreProcessInterceptor
{

    **@Context HttpServletRequest request; // WRONG WRONG WRONG**

    @Override
    public ServerResponse preProcess(HttpRequest arg0, ResourceMethod arg1) throws Failure, WebApplicationException
    {


        System.out.println(request.getRemoteAddr());
        System.out.println(request.getRemoteHost());
    }