Playframework get client IP from server, but not from cookies

Question

I would like to obtain client IP. Base on that IP I would like to give an access to application. Currently I am getting IP from cookies using this code:

/**
 * Gets the ip.
 *
 * @return the ip
 */
public static String getIP() {
    return Request play.mvc.Controller.request().remoteAddress();
}

But it is insecure, cause User can easily change it.

So I would like to obtain phisical IP addres from server connection instead of this one from cookie.

How can I achive this? Please help.

Answer 1

It's not a cookie... anyway simplest solution I can think of is ... hiding your app under some light HTTP server as a proxy and use its access restriction rules, the benefits:

• light server shouldn't be a bottleneck as it's dedicated to this job
• it's probably awared of tricks and hacks that hackers tries to walk around the restrictions
• denied IPs doesn't even get into your app, so you're saving resources
• it helps in general to solve several other tasks

Finally servers treat forwarded IPs in special way, i.e. when header manipulated like you show with curl, Apache will forward is as a list:

1.2.3.4,123.123.123.123

so you can catch bad IP anyway...