spring-projects / spring-projects/spring-security
[Enhancement request] IP of the user making the authentication
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Context
Hello,
I would like to reach out with a small question.
I did ask the same in Stack Overflow, but the question was closed, as they mentioned this is not an issue, there is no stack trace to paste, etc.
Therefore, could you please help me not be a ping pong ball between Stack Overflow and GitHub?
If I can get two minutes of your time.
There is a function in Spring Security that provides remote address.
final Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
final WebAuthenticationDetails webAuthenticationDetails = (WebAuthenticationDetails) authentication.getDetails();
final var remoteadress = webAuthenticationDetails.getRemoteAddress();
I think it is working, as I do get an IP.
I was wondering what IP I get?
Let us say the auth server is deployed in the US.
I have a first user Alice, who logs in from France
Another second user, Bob, logged in from Australia.
From the code above, the remote address is the IP of the user who is authenticating ( I get Alice's and Bob's IPs, one IP from France, another from Australia).
Or the server on which the user is authenticating. (The IP of the US one)
Is there a way to get it otherwise with Spring Security?
Thank you
Expected Behavior
I would like to get the IP of the user who is performing the auth.
Current Behavior
Not sure, hence the question
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The question centers on Spring Security's WebAuthenticationDetails.getRemoteAddress(), using the SecurityContextHolder authentication details shown in the issue. Read that entry point first and clarify or document which address it represents and whether Spring Security provides another supported way to obtain the authenticating user's IP; done means the behavior and alternative, if any, are explicitly answered.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, backend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100