spring-projects / spring-projects/spring-security

[Enhancement request] IP of the user making the authentication

Open
#18,294 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Context

Hello,

I would like to reach out with a small question.
I did ask the same in Stack Overflow, but the question was closed, as they mentioned this is not an issue, there is no stack trace to paste, etc.
Therefore, could you please help me not be a ping pong ball between Stack Overflow and GitHub?
If I can get two minutes of your time.

There is a function in Spring Security that provides remote address.

        final Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        final WebAuthenticationDetails webAuthenticationDetails = (WebAuthenticationDetails) authentication.getDetails();
        final var remoteadress = webAuthenticationDetails.getRemoteAddress();

I think it is working, as I do get an IP.
I was wondering what IP I get?

Let us say the auth server is deployed in the US.
I have a first user Alice, who logs in from France
Another second user, Bob, logged in from Australia.

From the code above, the remote address is the IP of the user who is authenticating ( I get Alice's and Bob's IPs, one IP from France, another from Australia).

Or the server on which the user is authenticating. (The IP of the US one)

Is there a way to get it otherwise with Spring Security?
Thank you

Expected Behavior

I would like to get the IP of the user who is performing the auth.

Current Behavior

Not sure, hence the question

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The question centers on Spring Security's WebAuthenticationDetails.getRemoteAddress(), using the SecurityContextHolder authentication details shown in the issue. Read that entry point first and clarify or document which address it represents and whether Spring Security provides another supported way to obtain the authenticating user's IP; done means the behavior and alternative, if any, are explicitly answered.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
authentication, backend, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.