private String getLoggableAddress ( HttpServletRequest request ) { // Log X-Forwarded-For, if present and valid String header = request . getHeader ( "X-Forwarded-For" ) ; if ( header != null && X_FORWARDED_FOR . matcher ( header ) . matches ( ) ) return "[" + header + ", " + request . getRemoteAddr ( ) + "]" ; // If header absent or invalid, just use source IP return request . getRemoteAddr ( ) ; }
Returns a formatted string containing an IP address or list of IP addresses which represent the HTTP client and any involved proxies . As the headers used to determine proxies can easily be forged this data is superficially validated to ensure that it at least looks like a list of IPs .