Question

I’m working on project using Java, in which IP address will be identity of the client/user. So I’m facing one problem: where user can spoof their host identity, that can lead to false identity of the user. So, anyone know, how to detect whether the host is using proxy or not?

InetAddress thisIp = InetAddress.getLocalHost();

I’m using above code to detect the host IP address.

Answer 1

You cannot 100% reliably check this, but to cover the most proxies, you could check the presence of the X-Forwarded-For request header.

if (request.getHeader("X-Forwarded-For") != null) {
    // Client is likely using a proxy.
}

There is no standard for this. Each proxy may have its own specific set of additional/custom headers. You could log the retrieved request headers and examine which headers are been set by certain proxies and then alter the code accordingly. Again, you cannot reliably check this. Some proxies may even have no additional headers at all. You’d need to maintain a list of IP addresses of “well known” proxies so that you can check getRemoteAddr() against it.

---

Unrelated to the concrete problem, as you tagged this with jsp, I would only add that writing Java code inside a JSP is a poor practice. You’d normally do this in a normal Java class like a servlet or a filter.