Search code examples
vaadin14

Vaadin 14: session browser ip address is always 127.0.0.1


I need the IP address of the browser of the current session. Currently I retrieve this by UI.getCurrent().getSession().getBrowser().getAddress() but this one always returns 127.0.0.1.

The idea is for instance that the application, packaged as a webapp on a tomcat, authenticate with badge readers and only authenticate when the IP address of the Vaadin session is equal to the IP address of the badge reader. To support that each badge reader (linked to computer x) can only authenticate actions on vaadin sessions with IP of computer x. Currently I compare the badge reader IP, 192.168.xxx.xxx, with the Vaadin session browser IP, but this one is always 127.0.0.1, which results in a mismatch and no successful authentication.

How can I retrieve the real, for instance 192.168.xxx.xxx address?


Solution

  • getAddress() is based on ServletRequest.getRemoteAddr() which in turn is based on the TCP connection to the server.

    If there is a proxy, gateway or load balancer in front of the server, then getRemoteAddr() will always be the IP address from which the proxy sends requests. In that case, there's often an X-Forwarded-For header in the HTTP request, but you'd then need to find the value through VaadinRequest.getCurrent() instead of through the WebBrowser class.

    If you're testing locally, then there might also be a difference in what URL you enter in the address bar in the browser. If you have e.g. http://localhost:8080, then the server will see 127.0.0.1 as the originating address. If you instead use the external IP address of the development machine, e.g. http://192.168.0.2, then the server will see that address for the TCP connection.