A question about java web apps and X-REAL-IP heade

问题:

I'm setting up a demo of a project for a client. On my server I have a lot of sites built with different technologies that are running under different servers on different ports. I'm using nginx as a reverse proxy for all of them. This particular application is built with java (spring MVC / Blazeds) and will be deployed under tomcat 6 for the demo (probably in production too). Nginx has a nice setting when used as reverse proxy that enables it to pass the IP address of the original request in the X-REAL-IP header. What I want to do is set up my application or at least tomcat to treat the X-REAL-IP header as the real request IP address. Is this possible?

回答1:

That depends on what you mean by "real request IP". If you're talking about the value returned from request.getRemoteAddr() then yes, it's possible.
The way to do that would be to set up a servlet filter in your web application that would intercept all URLs (or only the ones for which you want X-REAL-IP returned) and have that filter wrap incoming request into a descendant of HttpServletRequestWrapper which will override getRemoteAddr() to return X-REAL-IP value.

回答2:

You can do this using Tomcat's RemoteIpValve

<Valve className="org.apache.catalina.valves.RemoteIpValve"
           remoteIpHeader="X-REAL-IP"
           requestAttributesEnabled="true"
           internalProxies="127.0.0.1"  />

That way, when you call request.getRemoteAddr(), it will be providing the right information. By the way, you probably want to use the more standard header, which is X-Forwarded-For.