12

I'm configuring nginx as a reverse proxy in front of Tomcat 7. I added the following lines to nginx configuration:

set_real_ip_from 127.0.0.1;
...
location / {
    proxy_pass http://tomcat;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

But still, I see in Tomcat logs the following picture:

127.0.0.1 - - [10/Jun/2013:11:25:48 +0600] "GET /app/welcome;jsessionid=6C1B02376C5F748C509B28FC7CE416C9 HTTP/1.0" 200 10571
127.0.0.1 - - [10/Jun/2013:11:25:48 +0600] "GET /app/welcome;jsessionid=0BBE0174C1F0E94FDF49610144E809D3 HTTP/1.0" 200 10571
127.0.0.1 - - [10/Jun/2013:11:25:48 +0600] "GET /app/welcome;jsessionid=AD48005AD453F3A0BE46F1AC978F145D HTTP/1.0" 200 10571

Is there any way to force Tomcat to use X-Real-IP header (and write it to log files) without modifying web app?

5 Answers 5

16

It's required to add Valve in Tomcat configuration:

<Valve className="org.apache.catalina.valves.RemoteIpValve"
               remoteIpHeader="X-Forwarded-For"
               requestAttributesEnabled="true"
               internalProxies="127\.0\.0\.1"  />

After that Tomcat starts to dispatch headers passed from nginx:

proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
3
  • 5
    As per the documentation, internalProxies is expecting a regular expression, not a string literal. As such, 127.0.0.1 should please be 127\.0\.0\.1.
    – ziesemer
    Dec 10, 2015 at 17:49
  • 1
    requestAttributesEnabled goes in the AccessLogValve, not the RemoteIpValve, in Tomcat 7/8. Also, remoteIpHeader="X-Forwarded-For" is not required as that is the default value.
    – Stomf
    Jun 24, 2020 at 10:35
  • requestAttributesEnabled=true is the default in Tomcat 9.
    – Bertl
    Jun 8, 2021 at 13:23
5

Found this question via google, and want to add comment to the approved answer:

According to documentation, by default this valve (RemoteIpValve) has no effect on the values that are written into access log. In order to get real IPs in log, you should add

requestAttributesEnabled="true"

to AccessLogValve also.

2

Another useful example of Tomcat config: internalProxies can be separated with pipeline (|) since accepts regular expression.

<Valve
   className="org.apache.catalina.valves.RemoteIpValve"
   internalProxies="192\.168\.10\.110|127\.0\.0\.1"
   remoteIpHeader="x-forwarded-for"
   proxiesHeader="x-forwarded-by"
   protocolHeader="x-forwarded-proto"
   />

For more examples refer to tomcat document

1

I was searching for the same thing and found information leading me to the following solution from researching around the net.

In your tomcat server.xml you need to edit the logging valve pattern to get the values from the incoming header.

In your

and change the pattern to:

pattern="Remote User[ %{X-Forwarded-For}i %l %u %t ] Request[ &quot;%r&quot; ] Status Code[ %s ] Bytes[ %b ] Referer[ &quot;%{Referer}i&quot; ] Agent[ &quot;%{User-agent}i&quot; ] "

My full access log value looks like the following:

      <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
               prefix="access_log." suffix=".txt"
               pattern="Remote User[ %{X-Forwarded-For}i %l %u %t ] Request[ &quot;%r&quot; ] 
               Status Code[ %s ] Bytes[ %b ] Referer[ &quot;%{Referer}i&quot; ] 
               Agent[ &quot;%{User-agent}i&quot; ] " />

This is accompanied by the Nginx config of:

location / {
    proxy_pass http://localhost:8080;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_intercept_errors on;
}

Additional information of log valve patterns in Tomcat can be found at: Apache 7: The Valve Component

1
0

You'll need to install mod_realip http://httpd.apache.org/docs/trunk/mod/mod_remoteip.html (http://tomcat.apache.org/tomcat-7.0-doc/config/filter.html#Remote_IP_Filter) or mod_rpaf at the apache server.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .