Remove processing of X-Forwarded-For header.
@@ -41,27 +41,6 @@ public class Credentials implements Serializable {
*/
private static final long serialVersionUID = 1L;
- /**
- * Regular expression which matches any IPv4 address.
- */
- private static final String IPV4_ADDRESS_REGEX = "([0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3})";
-
- /**
- * Regular expression which matches any IPv6 address.
- */
- private static final String IPV6_ADDRESS_REGEX = "([0-9a-fA-F]*(:[0-9a-fA-F]*){0,7})";
-
- /**
- * Regular expression which matches any IP address, regardless of version.
- */
- private static final String IP_ADDRESS_REGEX = "(" + IPV4_ADDRESS_REGEX + "|" + IPV6_ADDRESS_REGEX + ")";
-
- /**
- * Pattern which matches valid values of the de-facto standard
- * "X-Forwarded-For" header.
- */
- private static final Pattern X_FORWARDED_FOR = Pattern.compile("^" + IP_ADDRESS_REGEX + "(, " + IP_ADDRESS_REGEX + ")*$");
-
/**
* An arbitrary username.
*/
@@ -116,16 +95,7 @@ public class Credentials implements Serializable {
this.password = password;
this.request = request;
- // Use X-Forwarded-For to get remote address, if present and valid
- String header = request.getHeader("X-Forwarded-For");
- if (header != null) {
- Matcher matcher = X_FORWARDED_FOR.matcher(header);
- if (matcher.matches())
- this.remoteAddress = matcher.group(1);
- }
-
- // Header not present, just use remote address
- else
+ // Set the remote address
this.remoteAddress = request.getRemoteAddr();
// Get the remote hostname
