/** * 獲取Ip * * @param request 請求 */ public static String getIpRequest(HttpServletRequest request) { String unknown = "unknown"; String ip0 = request.getHeader("x-forwarded-for"); String ip = request.getHeader("X-Real-IP"); if (ip == null || ip.length() == 0 || unknown.equalsIgnoreCase(ip)) { ip = request.getHeader("Proxy-Client-IP"); } if (ip == null || ip.length() == 0 || unknown.equalsIgnoreCase(ip)) { ip = request.getHeader("WL-Proxy-Client-IP"); } if (ip == null || ip.length() == 0 || unknown.equalsIgnoreCase(ip)) { ip = request.getRemoteAddr(); } if (LOCAL_IP.equals(ip)) { ip = "local"; } return ip; }使用x-forwarded-for的話ip容易被偽造, 使用postman也可以模擬復現, 所以建議使用X-Real-IP獲取真實Ip, 如果存在偽造Ip漏洞的話還需要Nginx配置一下X-Real-IP當只有1層nginx代理情況下只需配置 “proxy_set_header X-Real-IP $remote_addr;”即可， 當有多層反向代理時，只在最外層代理設定 “proxy_set_header X-Real-IP $remote_addr;”， 如果在非最外層設定，則獲取到的是反向代理機器的ip
轉載請註明出處，本文鏈接：https://www.uj5u.com/qita/299057.html
標籤：其他
下一篇：Linux學習記錄