How to Find the Client's Remote IP Address

As a seasoned web engineer, I want to explain a crucial utility function that solves a common challenge in web applications: accurately determining a client's IP address when working with proxy servers and load balancers.

The Challenge

In modern web architectures, requests often pass through multiple intermediaries (proxies, CDNs, load balancers) before reaching your application server. This makes it tricky to determine the original client's IP address, as request.getRemoteAddr() alone will only give you the address of the immediate connecting client (often a proxy).

The Solution

Let's analyze this solution:

static public String parseIpAddress(HttpServletRequest request) {
    List<String> headers = List.of("Cf-Connecting-IP", "X-Forwarded-For", "X-Real-IP");
    for (String header : headers) {
        String headerValue = request.getHeader(header);
        if (headerValue != null && !headerValue.isEmpty()) {
            return headerValue.split(",")[0].trim();
        }
    }
    return request.getRemoteAddr();
}

Header Priority List

List<String> headers = List.of("Cf-Connecting-IP", "X-Forwarded-For", "X-Real-IP");

Check the most specific headers first:

• Cf-Connecting-IP: Specific to Cloudflare, contains the original client IP
• X-Forwarded-For: Industry standard header for tracking IP chains
• X-Real-IP: Alternative header used by some proxy servers like Nginx

Header Processing Logic

- Iterates through headers in priority order
- Returns the first non-null, non-empty header value found
- Uses `split(",")[0]` to get the leftmost IP (original client) from potential chains
- `trim()` removes any whitespace

Fallback Mechanism

return request.getRemoteAddr();

Always returns an IP, even if proxy headers aren't present, by using the direct connection IP

Why This Matters

1. Security: Accurate IP identification is crucial for:

   • Rate limiting
   • Geo-blocking
   • Access control
   • Fraud detection

2. Analytics: Proper user location tracking and metrics

3. Compliance: Many regulations require accurate client IP logging