jsp get ip address

Question

Hello, whats the best way of preventing someone from voting twice? How do i get the users ip address? What if they are on a large network? will everyone on that network show the same ip? thanks

---

UPDATE: request.getRemoteAddr() and request.getRemoteHost() return the Server names, not the client's host name and ip. Anyone else got any bright ideas?

---

Ok, so lets forget about the voting twice thing. Im just trying to get the users ip address? i tried request.getRemoteAddr() and request.getRemoteHost() and think im getting the servers address. I have access to two separate networks and am getting the same IP address :(

Answer 1

In your JSP, use request.getRemoteAddr(). This returns the IP address of the agent that sent the request as a String.

Also, request.getRemoteHost() will attempt to get the fully qualified host name. If it can't resolve the name however, the IP address will be returned as in getRemoteAddr().

Answer 2

You can get the IP address with request.getRemoteAddr(). If the network is using a NAT router, all users will get the same address though

Answer 3

If users are behind NAT router or proxy server, you will see them with the same IP address. Therefore, it is not the best way of allowing users to vote once.

An alternative would be to use cookies, but again, it is possible to erase the cookie and vote again.

Answer 4

AFAIK the ONLY way of preventing a second vote is by authenticating. Obviously this is not always possible, so you have to mitigate the possibility of a single user casting a ton of votes.

• Throttle the voting by source IP. Use the getRemoteAddr() to allow, say... a vote per hour?... per minute? ... it will depend on how much voting you expect. Adjust the number according to experience.
• Plant a cookie on the response for every voting poll, which expires after the ballot closes.
• Make it harder to forge requests by checking and validating headers like Referer and User-Agent.

Answer 5

Ad UPDATE: are you using reverse proxy? Is there any Apache behind your java application server?

Answer 6

To get the IP of a client behind a router/firewall you can use request.getHeader("X-FORWARDED-FOR").

The X-Forwarded-For (XFF) HTTP header is a de facto standard for identifying the originating IP address of a client connecting to a web server through an HTTP proxy or load balancer. http://en.wikipedia.org/wiki/X-Forwarded-For

Keep in mind though, that this value can be changed by the proxies between you and the client. Though it should be the correct IP.