使用nginx代理后以及配置https后,如何获取真实的ip地址

时间:2022-10-21 06:58:17

使用nginx代理后以及配置https后,如何获取真实的ip地址

Date:2018-8-27 14:15:51

使用nginx, apache等反向代理后,如果想获取请求的真实ip,要在nginx中配置,把当前请求的ip等信息携带去请求应用服务。

1.配置nginx的https servler

  • nginx.conf配置
server {
listen 80;
server_name edudemo.XXX.com;
# 如果配置了下面的rewrite,下面的location就没用了,会直接转发到下面的https去请求
rewrite ^(.*)$ https://$host$1 permanent;
location / {
proxy_pass https://edudemo.XXX.com;
proxy_set_header Host $host;
proxy_set_header X-real-ip $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
} server {
listen 443;
server_name edudemo.XXX.com;
ssl on;
root html;
index index.html index.htm;
ssl_certificate cert/214421564860931.pem;
ssl_certificate_key cert/214421564860931.key;
ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
location / {
proxy_pass http://127.0.0.1:8083;
# 获取请求的host
proxy_set_header Host $host;
# 获取请求的ip地址
proxy_set_header X-real-ip $remote_addr;
# 获取请求的多级ip地址,当请求经过多个反向代理时,会获取多个ip,英文逗号隔开
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}

2.代码中获取真实的ip地址

    /**
* 获取请求主机IP地址,如果通过代理进来,则透过防火墙获取真实IP地址;
*
* @param request
* @return
* @throws IOException
*/
public final static String getIpAddress(HttpServletRequest request) throws IOException {
// 获取nginx代理前的ip地址
String ip = request.getHeader("X-real-ip");
if (logger.isInfoEnabled()) {
logger.info("getIpAddress(X-real-ip) - X-real-ip - String ip=" + ip);
}
// 获取所有代理记录的ip地址
String refererIps = request.getHeader("x-forwarded-for");
String[] split = refererIps.trim().split(",");
if (split != null && split.length >= 2) {
// 获取请求最开始的ip
ip = split[0];
logger.info("getIpAddress(x-forwarded-for) - x-forwarded-for - String ip=" + refererIps);
}
if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
ip = request.getHeader("Proxy-Client-IP");
if (logger.isInfoEnabled()) {
logger.info("getIpAddress(HttpServletRequest) - Proxy-Client-IP - String ip=" + ip);
}
}
if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
ip = request.getHeader("WL-Proxy-Client-IP");
if (logger.isInfoEnabled()) {
logger.info("getIpAddress(HttpServletRequest) - WL-Proxy-Client-IP - String ip=" + ip);
}
}
if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
ip = request.getHeader("HTTP_CLIENT_IP");
if (logger.isInfoEnabled()) {
logger.info("getIpAddress(HttpServletRequest) - HTTP_CLIENT_IP - String ip=" + ip);
}
}
if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
ip = request.getHeader("HTTP_X_FORWARDED_FOR");
if (logger.isInfoEnabled()) {
logger.info("getIpAddress(HttpServletRequest) - HTTP_X_FORWARDED_FOR - String ip=" + ip);
}
}
if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
ip = request.getRemoteAddr();
if (logger.isInfoEnabled()) {
logger.info("getIpAddress(HttpServletRequest) - getRemoteAddr - String ip=" + ip);
}
}
} else if (ip.length() > 15) {
String[] ips = ip.split(",");
for (int index = 0; index < ips.length; index++) {
String strIp = (String) ips[index];
if (!("unknown".equalsIgnoreCase(strIp))) {
ip = strIp;
break;
}
}
}
logger.info("final request ip : {}", ip);
return ip;
}

获取到真实的ip后就可以去对用户进行限制了,ip访问次数限制,ip黑名单过滤。。。

参考:https://www.cnblogs.com/zhanghaoh/p/5293158.html