jsp get ip address

Question

whats the best way of preventing someone from voting twice? How do i get the users ip address? What if they are on a large network? will everyone on that network show the sa

Answer 1

If users are behind NAT router or proxy server, you will see them with the same IP address. Therefore, it is not the best way of allowing users to vote once.

An alternative would be to use cookies, but again, it is possible to erase the cookie and vote again.

Answer 2

In your JSP, use request.getRemoteAddr(). This returns the IP address of the agent that sent the request as a String.

Also, request.getRemoteHost() will attempt to get the fully qualified host name. If it can't resolve the name however, the IP address will be returned as in getRemoteAddr().

Answer 3

You can get the IP address with request.getRemoteAddr(). If the network is using a NAT router, all users will get the same address though

Answer 4

In your JSP page simply use this expression: ${pageContext.request.remoteAddr}

Answer 5

AFAIK the ONLY way of preventing a second vote is by authenticating. Obviously this is not always possible, so you have to mitigate the possibility of a single user casting a ton of votes.

• Throttle the voting by source IP. Use the getRemoteAddr() to allow, say... a vote per hour?... per minute? ... it will depend on how much voting you expect. Adjust the number according to experience.
• Plant a cookie on the response for every voting poll, which expires after the ballot closes.
• Make it harder to forge requests by checking and validating headers like Referer and User-Agent.

Answer 6

To get the IP of a client behind a router/firewall you can use request.getHeader("X-FORWARDED-FOR").

The X-Forwarded-For (XFF) HTTP header is a de facto standard for identifying the originating IP address of a client connecting to a web server through an HTTP proxy or load balancer. http://en.wikipedia.org/wiki/X-Forwarded-For

Keep in mind though, that this value can be changed by the proxies between you and the client. Though it should be the correct IP.